Privacy Of Sensitive Data Research Articles

Network-Based Contact Tracing for Detection of Covid-19 Contagions: A Privacy-Preserving Approach

The outbreak of coronavirus 2019 (Covid-19) has imposed a worldwide lockdown, changing the way people live and work, and pressuring the healthcare systems in many countries. Contact tracing based on smartphone apps (app-based contact tracing) has emerged as a possible solution to trace contagions and enforce more sustainable and selective quarantines. However, these apps require a very high adoption rate to reach the critical mass for effective contact tracing. As an alternative, network-based contact tracing, which exploits geo-localization in next generation networks (e.g., 5G) can be used by mobile operators (MOs) to passively trace users' mobility and contacts, provided that a targeted localization accuracy of down to one meter can be achieved. To effectively trace contagions, the identities of positive individuals, which are known by governmental authorities (GAs), are also required. Hence, in network-based contact tracing, MOs and GAs must exchange users' privacy-sensitive data, as geo-locations and infection status, to compute the likelihood that an individual has been infected. To address the privacy issues raised by network contact tracing, after presenting an overview of app-based vs. network-based contact tracing systems, we propose a protocol to make network-based systems compliant with stringent privacy requirements. From extensive simulations, we observe that the cost to guarantee privacy (evaluated in terms of data overhead introduced by the protocol) is acceptable. Finally, we elaborate on the advantages of the proposed system (e.g., more efficient monitoring of virus spread), as well as on the open issues that should be solved before its adoption (e.g., extensive research on potential privacy leakage is required).

Blockchain-Enabled SLA Compliance for Crowdsourced Edge-Based Network Function Virtualization

Network function virtualization (NFV) allows edge devices to host different types of virtual network functions (VNFs) and support Computing in the Network. Therefore, an edge device can abstract multiple VNFs of different infrastructure providers (InPs) as services and serve them at different times to act as a tenant for different InPs. Deploying edge devices is expensive and difficult to manage. Hence, crowdsourced edge devices can be used. To ensure the quality and availability of the services and the privacy of sensitive data of the service stakeholders, it is extremely important to establish a service level agreement (SLA) between an edge device owner and an InP. For monitoring of SLA compliance and enforcing accountability, a trusted platform is required. The traditional NFV management authority cannot be trusted due to its centralized characteristics. In this article, we propose a blockchain-powered framework for the SLA compliance of edge devices offering VNFs as services and introduce a smart contract-driven framework to establish trust in edge-based NFV. We analyze the performance of the proposed framework in the context of a private blockchain network.

From cloud computing security towards homomorphic encryption: A comprehensive review

“Cloud computing” is a new technology that revolutionized the world of communications and information technologies. It collects a large number of possibilities, facilities, and developments, and uses the combining of various earlier inventions into something new and compelling. Despite all features of cloud computing, it faces big challenges in preserving data confidentiality and privacy. It has been subjected to numerous attacks and security breaches that have prompted people to hesitate to adopt it. This article provided comprehensive literature on the cloud computing concepts with a primary focus on the cloud computing security field, its top threats, and the protection against each one of them. Data security/privacy in the cloud environment is also discussed and homomorphic encryption (HE) was highlighted as a popular technique used to preserve the privacy of sensitive data in many applications of cloud computing. The article aimed to provide an adequate overview of both researchers and practitioners already working in the field of cloud computing security, and for those new in the field who are not yet fully equipped to understand the detailed and complex technical aspects of cloud computing.

Tweet-scan-post: a system for analysis of sensitive private data disclosure in online social media

Tweet-scan-post: a system for analysis of sensitive private data disclosure in online social media

Refiner

Modern mobile applications often produce decentralized data, i.e., a huge amount of privacy-sensitive data distributed over a large number of mobile devices. Techniques for learning models from decentralized data must properly handle two natures of such data, namely privacy and massive engagement. Federated learning (FL) is a promising approach for such a learning task since the technique learns models from data without exposing privacy. However, traditional FL methods assume that the participating mobile devices are honest volunteers. This assumption makes traditional FL methods unsuitable for applications where two kinds of participants are engaged: 1) self-interested participants who, without economical stimulus, are reluctant to contribute their computing resources unconditionally, and 2) malicious participants who send corrupt updates to disrupt the learning process. This paper proposes Refiner, a reliable federated learning system for tackling the challenges introduced by massive engagements of self-interested and malicious participants. Refiner is built upon Ethereum, a public blockchain platform. To engage self-interested participants, we introduce an incentive mechanism which rewards each participant in terms of the amount of its training data and the performance of its local updates. To handle malicious participants, we propose an audit scheme which employs a committee of randomly chosen validators for punishing them with no reward and preclude corrupt updates from the global model. The proposed incentive and audit scheme is implemented with cryptocurrency and smart contract, two primitives offered by Ethereum. This paper demonstrates the main features of Refiner by training a digit classification model on the MNIST dataset.

A Novel Cloud-Assisted Secure Deep Feature Classification Framework for Cancer Histopathology Images

The advancements in the Internet of Things (IoT) and cloud services have enabled the availability of smart e-healthcare services in a distant and distributed environment. However, this has also raised major privacy and efficiency concerns that need to be addressed. While sharing clinical data across the cloud that often consists of sensitive patient-related information, privacy is a major challenge. Adequate protection of patients’ privacy helps to increase public trust in medical research. Additionally, DL-based models are complex, and in a cloud-based approach, efficient data processing in such models is complicated. To address these challenges, we propose an efficient and secure cancer diagnostic framework for histopathological image classification by utilizing both differential privacy and secure multi-party computation. For efficient computation, instead of performing the whole operation on the cloud, we decouple the layers into two modules: one for feature extraction using the VGGNet module at the user side and the remaining layers for private prediction over the cloud. The efficacy of the framework is validated on two datasets composed of histopathological images of the canine mammary tumor and human breast cancer. The application of differential privacy preserving to the proposed model makes the model secure and capable of preserving the privacy of sensitive data from any adversary, without significantly compromising the model accuracy. Extensive experiments show that the proposed model efficiently achieves the trade-off between privacy and model performance.

ESCAPED: Efficient Secure and Private Dot Product Framework for Kernel-based Machine Learning Algorithms with Applications in Healthcare

Training sophisticated machine learning models usually requires many training samples. Especially in healthcare settings these samples can be very expensive, meaning that one institution alone usually does not have enough. Merging privacy-sensitive data from different sources is usually restricted by data security and data protection measures. This can lead to approaches that reduce data quality by putting noise onto the variables (e.g., in epsilon-differential privacy) or omitting certain values (e.g., for k-anonymity). Other measures based on cryptographic methods can lead to very time-consuming computations, which is especially problematic for larger multi-omics data. We address this problem by introducing ESCAPED, which stands for Efficient SeCure And PrivatE Dot product framework. ESCAPED enables the computation of the dot product of vectors from multiple sources on a third-party, which later trains kernel-based machine learning algorithms, while neither sacrificing privacy nor adding noise. We have evaluated our framework on drug resistance prediction for HIV-infected people and multi-omics dimensionality reduction and clustering problems in precision medicine. In terms of execution time, our framework significantly outperforms the best-fitting existing approaches without sacrificing the performance of the algorithm. Even though we only present the benefit for kernel-based algorithms, our framework can open up new research opportunities for further machine learning models that require the dot product of vectors from multiple sources.

Security and Privacy of Sensitive Data in Cloud Computing Using RSA

Today's world internet is being used by almost everyone. Numerous file exchanges take place online including many official documents. These files require some sort of security mechanisms while being transmitted over the Internet. Technology has done a great deal for changing the way we live and do business today. In the fast-moving world we need something essential for fast computation. Along with the popular use of computer, Information security has also become one of the problems which need to be solved. Many security issues like the malware authors, information leakage, endangerment and unauthorized exploitation need to be taken into account. To control those issues, crypto-security is necessary. More Applications started to use Rivest–Shamir–Adleman (RSA). However, Since RSA on large blocks is computationally intensive and largely byte-parallel. System will parallel perform the encryption and decryption process in a distributed environment and the performance analysis shows improvement in terms of execution time and provides the security.

NN-EMD: Efficiently Training Neural Networks Using Encrypted Multi-Sourced Datasets

Training complex neural network models using third-party cloud-based infrastructure among multiple data sources is a promising approach among existing machine learning solutions. However, privacy concerns of large-scale data collections and recent regulations have restricted the availability and use of privacy sensitive data in the third-party infrastructure. To address such privacy issues, a promising emerging approach is to train a neural network model over an encrypted dataset. Specifically, the model training process can be outsourced to a third party such as a cloud service that is backed by significant computing power, while the encrypted training data keeps the data confidential from the third party. Compared to training a traditional machine learning model over encrypted data, however, it is extremely challenging to train a deep neural network (DNN) model over encrypted data for two reasons: first, it requires large-scale computation over huge datasets; second, the existing solutions for computation over encrypted data, such as using homomorphic encryption, is inefficient. Further, for enhanced performance of a DNN model, we also need to use huge training datasets composed of data from multiple data sources that may not have pre-established trust relationships among each other. We propose a novel framework, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NN-EMD</i> , to train DNN over <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">encrypted multiple datasets</i> collected from multiple sources. Toward this, we propose a set of secure computation protocols using hybrid functional encryption schemes. We evaluate our framework for performance with regards to the training time and model accuracy on the MNIST datasets. We show that compared to other existing frameworks, our proposed <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NN-EMD</i> framework can significantly reduce the training time, while providing comparable model accuracy and privacy guarantees as well as supporting multiple data sources. Furthermore, the depth and complexity of neural networks do not affect the training time despite introducing a privacy-preserving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">NN-EMD</i> setting.

Model Inversion Attack: Analysis under Gray-box Scenario on Deep Learning based Face Recognition System

In a wide range of ML applications, the training data contains privacy-sensitive information that should be kept secure. Training the ML systems by privacy-sensitive data makes the ML model inherent to the data. As the structure of the model has been fine-tuned by training data, the model can be abused for accessing the data by the estimation in a reverse process called model inversion attack (MIA). Although, MIA has been applied to shallow neural network models of recognizers in literature and its threat in privacy violation has been approved, in the case of a deep learning (DL) model, its efficiency was under question. It was due to the complexity of a DL model structure, big number of DL model parameters, the huge size of training data, big number of registered users to a DL model and thereof big number of class labels. This research work first analyses the possibility of MIA on a deep learning model of a recognition system, namely a face recognizer. Second, despite the conventional MIA under the white box scenario of having partial access to the users' non-sensitive information in addition to the model structure, the MIA is implemented on a deep face recognition system by just having the model structure and parameters but not any user information. In this aspect, it is under a semi-white box scenario or in other words a gray-box scenario. The experimental results in targeting five registered users of a CNN-based face recognition system approve the possibility of regeneration of users' face images even for a deep model by MIA under a gray box scenario. Although, for some images the evaluation recognition score is low and the generated images are not easily recognizable, but for some other images the score is high and facial features of the targeted identities are observable. The objective and subjective evaluations demonstrate that privacy cyber-attack by MIA on a deep recognition system not only is feasible but also is a serious threat with increasing alert state in the future as there is considerable potential for integration more advanced ML techniques to MIA.

PC-SyncBB: A privacy preserving collusion secure DCOP algorithm

In recent years, several studies proposed privacy-preserving algorithms for solving Distributed Constraint Optimization Problems (DCOPs). Those studies were based on existing DCOP solving algorithms, which they strengthened by implementing cryptographic weaponry that enabled performing the very same computation while protecting sensitive private data. All of those studies assumed that agents do not collude. In this study we propose the first privacy-preserving DCOP algorithm that is immune to coalitions. Our basic algorithm is secure against any coalition under the assumption of an honest majority (namely, the number of colluding agents is <n/2, where n is the overall number of agents). We then proceed to describe two variants of that basic algorithm: a more efficient variant that is secure against coalitions of size ≤c, for some constant c<(n−1)/2; and another variant that is immune to agent coalitions of any size, but relies on an external committee of mediators with an honest majority. Our algorithm – PC-SyncBB – is based on the classical Branch and Bound DCOP algorithm. It offers constraint, topology and decision privacy. We evaluate its performance on different benchmarks, problem sizes, and constraint densities. We show that achieving security against coalitions is feasible. Our experiments indicate that PC-SyncBB can run in reasonable time on problems involving up to 19 agents. As all existing privacy-preserving DCOP algorithms base their security on assuming solitary conduct of the agents, we view this study as an essential first step towards lifting this potentially harmful assumption in all those algorithms.

Towards an Architecture-based Ensemble Methods for Online Social Network Sensitive Data Privacy Protection

&lt;p&gt;&lt;strong&gt;Abstract - &lt;/strong&gt;In 2014, the world woke up to a giant data breach that leveraged users’ personal information that was taken from one of the world’s biggest social network platform. Based on the literature, this was possible because of the Centralised Architectural-based Approach to protecting the privacy of users’ online data. Although the literature is inundated with decentralized approaches, there is none to the best of our knowledge that uses an ensemble of methods and draws on a consensus mechanism to address the challenges caused by the Centralised Architectural-based Approach. This paper presents a decentralized approach that adopts and adapts an ensemble of methods. These methods include cryptographic, hashing, and the plenum byzantine fault tolerance algorithms that present a consensus platform, protocol, and mechanism to use the technology of blockchain in a novel manner as a significant contribution. This paper adopts the descriptive approach in its presentation as the usable implementation of the presented proposal is near completion with issues of computational overhead addressed based on preliminary results that show promise of being able to support agreement up to ≈ 75% in terms of making changes by participants in the chain. &lt;strong&gt;&lt;/strong&gt;&lt;/p&gt;

The value of federated learning during and post-COVID-19.

Federated learning (FL) as a distributed machine learning (ML) technique has lately attracted increasing attention of healthcare stakeholders as FL is perceived as a promising decentralized approach to address data privacy and security concerns. The FL approach stores and maintains the privacy-sensitive data locally while allows multiple sites to train ML models collaboratively. We aim to describe the most recent real-world cases using the FL in both COVID-19 and non-COVID-19 scenarios and also highlight current limitations and practical challenges of FL.

An AI-Enabled Three-Party Game Framework for Guaranteed Data Privacy in Mobile Edge Crowdsensing of IoT

The mobile crowdsensing (MCS) technology with a large number of Internet of Things (IoT) devices provides an economic and efficient solution to participation in coordinated large-scale sensing tasks. Edge computing powers MCS to form the mobile edge crowdsensing (MECS) framework. Privacy disclosure of sensing data in multiple stages is a significant challenge in the MECS. To tackle this issue, combining machine learning with game theory, in this article, we propose an artificial intelligence (AI)-enabled three-party game (ATG) framework for guaranteed data privacy in the MECS of IoT. Specifically, based on the random forest classifier and the k-anonymity algorithm, we propose a classification-anonymity model that effectively guarantees the privacy of sensitive data. Moreover, we construct a three-party game model for analyzing the data privacy leakage in different phases in the MECS. Finally, we conduct numerical and theoretical analyses and ample simulations. The results indicate that the ATG framework is effective and efficient, and better suited to the MECS of IoT.

Intelligent Dynamic Malware Detection using Machine Learning in IP Reputation for Forensics Data Analytics

In the near future, objects have to connect with each other which can result in gathering private sensitive data and cause various security threats and cyber crimes. To prevent cyber crimes, novel cyber security techniques are required that can identify malicious Internet Protocol (IP) addresses before communication. One of the best techniques is the IP reputation system used for profiling the behavior of security threats to the cyber–physical system. Existing reputation systems do not perform well due to their high management cost, false-positive rate, consumption time, and considering very few data sources for claiming IP address reputation. To overcome the aforementioned issues, we have proposed a novel hybrid approach based on Dynamic Malware Analysis, Cyber Threat Intelligence, Machine Learning (ML), and Data Forensics. Using the concept of big data forensics, IP reputation is predicted in its pre-acceptance stage and its associated zero-day attacks are categorized via behavioral analysis by applying the Decision Tree (DT) technique. The proposed approach highlights the big data forensic issues and computes severity, risk score along with assessing the confidence and lifespan simultaneously. The proposed system is evaluated in two ways; first, we compare the ML techniques to attain the best F-measure, precision and recall scores, and then we compare the entire reputation system with the existing reputation systems. Our proposed framework is not only cross checked with external sources but also able to reduce the security issues which were neglected by existing outdated reputation engines.

Vulnerabilities in Federated Learning

With more regulations tackling the protection of users’ privacy-sensitive data in recent years, access to such data has become increasingly restricted. A new decentralized training paradigm, known as Federated Learning (FL), enables multiple clients located at different geographical locations to learn a machine learning model collaboratively without sharing their data. While FL has recently emerged as a promising solution to preserve users’ privacy, this new paradigm’s potential security implications may hinder its widespread adoption. The existing FL protocols exhibit new unique vulnerabilities that adversaries can exploit to compromise the trained model. FL is often preferred in learning environments where security and privacy are the key concerns. Therefore, it is crucial to raise awareness of the consequences resulting from the new threats to FL systems. To date, the security of traditional machine learning systems has been widely examined. However, many open challenges and complex questions are still surrounding FL security. In this paper, we bridge the gap in FL literature by providing a comprehensive survey of the unique security vulnerabilities exposed by the FL ecosystem. We highlight the vulnerabilities sources, key attacks on FL, defenses, as well as their unique challenges, and discuss promising future research directions towards more robust FL.

The Discrete Gaussian Expectation Maximization (Gradient) Algorithm for Differential Privacy.

In this paper, we give a modified gradient EM algorithm; it can protect the privacy of sensitive data by adding discrete Gaussian mechanism noise. Specifically, it makes the high-dimensional data easier to process mainly by scaling, truncating, noise multiplication, and smoothing steps on the data. Since the variance of discrete Gaussian is smaller than that of the continuous Gaussian, the difference privacy of data can be guaranteed more effectively by adding the noise of the discrete Gaussian mechanism. Finally, the standard gradient EM algorithm, clipped algorithm, and our algorithm (DG-EM) are compared with the GMM model. The experiments show that our algorithm can effectively protect high-dimensional sensitive data.

BZKP: Blockchain-based zero-knowledge proof model for enhancing healthcare security in Bahrain IoT smart cities and COVID-19 risk mitigation

Smart cities achieved digital transformation of patients’ health records through the use of new technology in IoT healthcare industry. Such technologies of using IoT and remote patient monitoring systems have become dramatically fundamental to reduce the movement of patients, and hence reducing the risk of spreading Covid-19 infection. The Ministry of Health in the Kingdom of Bahrain strives to achieve digital transformation in the healthcare industry, where the National Health Information System (I-SEHA) was launched to provide higher-quality health services. The system interconnects the public healthcare institutes, allowing access to patient’s data from any location without the hassle of moving the files physically. Digitization of medical data of patients and sharing some of the data with other institutions outside the protected networks may lead to major privacy and integrity concerns. This paper introduces Blockchain-based Zero-Knowledge Proof (BZKP) model, which is an IoT-based patient-centric model that fuses a zero-knowledge proof solution to be developed for protecting patient’s privacy, and ensures patients prior consent on any access to their data including their health status and account balance. The proposed model is developed to provide a robust and scalable architecture for data sharing, which protects the privacy of sensitive data while maintaining high availability. It also provides strong trust and integrity of data by using the immutability features of the blockchain. BZKP is based on pre-approved blockchain access tokens to address challenges of accountability and privacy in Bahrain smart cities. As a result, the model provides a secure and trusted access model between different stakeholders to share patient data while maintaining privacy, trust, and high availability. The zero-knowledge proof can be used with the smart contracts, which provides programmable actions that can be used for automating the prescriptions dispensation process for private pharmacies in a decentralized manner with high confidence. Finally, it recommends enhanced electronic key (eKey) procedures used by eGovernment of the Kingdom of Bahrain to update the smart card which stores the personal keys for protecting patient’s privacy and provide better consent.

Distributed Deep Learning Optimized System over the Cloud and Smart Phone Devices

Deep learning has been becoming a promising focus in data mining research. With deep learning techniques, researchers can discover deep properties and features of events from quantitative mobile sensor data. However, many data sources are geographically separated and have strict privacy, security, and regulatory constraints. Upon releasing the privacy-sensitive data, these data sources generally no longer physically possess their data and cannot interfere with the way their personal data being used. Therefore, it is necessary to explore distributed data mining architecture which is able to conduct consensus learning based on needs. Accordingly, we propose a distributed deep learning optimized system which contains a cloud server and multiple smartphone devices with computation capabilities and each device is served as a personal mobile data hub for enabling mobile computing while preserving data privacy. The proposed system keeps the private data locally in smartphones, shares trained parameters, and builds a global consensus model. The feasibility and usability of the proposed system are evaluated by three experiments and related discussion. The experimental results show that the proposed distributed deep learning system can reconstruct the behavior of centralized training. We also measure the cumulative network traffic in different scenarios and show that the partial parameter sharing strategy does not only preserve the performance of the trained model but also can reduce network traffic. User data privacy is protected on two levels. First, local private training data do not need to be shared with other people and the user has full control of their personal training data all the time. Second, only a small fraction of trained gradients of the local model are selected for sharing, which further reduces the risk of information leaking.

Accelerating Federated Learning for IoT in Big Data Analytics With Pruning, Quantization and Selective Updating

The ever-increasing number of Internet of Things (IoT) devices are continuously generating huge masses of data, but the current cloud-centric approach for IoT big data analysis has raised public concerns on both data privacy and network cost. Federated learning (FL) recently emerges as a promising technique to accommodate these concerns, by means of learning a global model by aggregating local updates from multiple devices without sharing the privacy-sensitive data. However, IoT devices usually have constrained computation resources and poor network connections, making it infeasible or very slow to train deep neural networks (DNNs) by following the FL pattern. To address this problem, we propose a new efficient FL framework called FL-PQSU in this paper. It is composed of 3-stage pipeline: structured pruning, weight quantization and selective updating, that work together to reduce the costs of computation, storage, and communication to accelerate the FL training process. We study FL-PQSU using popular DNN models (AlexNet, VGG16) and publicly available datasets (MNIST, CIFAR10), and demonstrate that it can well control the training overhead while still guaranteeing the learning performance.