Strong Privacy Research Articles

Who Can Find My Devices? Security and Privacy of Apple’s Crowd-Sourced Bluetooth Location Tracking System

Abstract Overnight, Apple has turned its hundreds-of-million-device ecosystem into the world’s largest crowd-sourced location tracking network called o~ine finding (OF). OF leverages online finder devices to detect the presence of missing o~ine devices using Bluetooth and report an approximate location back to the owner via the Internet. While OF is not the first system of its kind, it is the first to commit to strong privacy goals. In particular, OF aims to ensure finder anonymity, prevent tracking of owner devices, and confidentiality of location reports. This paper presents the first comprehensive security and privacy analysis of OF. To this end, we recover the specifications of the closed-source OF protocols by means of reverse engineering. We experimentally show that unauthorized access to the location reports allows for accurate device tracking and retrieving a user’s top locations with an error in the order of 10 meters in urban areas. While we find that OF’s design achieves its privacy goals, we discover two distinct design and implementation flaws that can lead to a location correlation attack and unauthorized access to the location history of the past seven days, which could deanonymize users. Apple has partially addressed the issues following our responsible disclosure. Finally, we make our research artifacts publicly available.

PPaaS: Privacy Preservation as a Service

Personally identifiable information (PII) can find its way into cyberspace through various channels, and many potential sources can leak such information. Data sharing (e.g. cross-agency data sharing) for machine learning and analytics is one of the important components in data science. However, due to privacy concerns, data should be enforced with strong privacy guarantees before sharing. Different privacy-preserving approaches were developed for privacy preserving data sharing; however, identifying the best privacy-preservation approach for the privacy-preservation of a certain dataset is still a challenge. Different parameters can influence the efficacy of the process, such as the characteristics of the input dataset, the strength of the privacy-preservation approach, and the expected level of utility of the resulting dataset (on the corresponding data mining application such as classification). This paper presents a framework named Privacy Preservation as aService (PPaaS) to reduce this complexity. The proposed method employs selective privacy preservation via data perturbation and looks at different dynamics that can influence the quality of the privacy preservation of a dataset. PPaaS includes pools of data perturbation methods, and for each application and the input dataset, PPaaS selects the most suitable data perturbation approach after rigorous evaluation. It enhances the usability of privacy-preserving methods within its pool; it is a generic platform that can be used to sanitize big data in a granular, application-specific manner by employing a suitable combination of diverse privacy-preserving algorithms to provide a proper balance between privacy and utility.

Deduplication Supporting Strong Privacy Protection for Cloud Storage

Cloud computing is developing as the following disruptive utility worldview. It gives broad capacity capabilities and an environment for application engineers through virtual machines. Third-party inspectors (TPAs) are becoming more common in cloud computing implementations. Consequently, including reviewers comes with its issues such as belief and preparing overhead To achieve productive examining, we ought to (1) fulfill efficiently auditing without asking the information area or introducing preparing overhead to the cloud client; (2) avoid presenting unused security vulnerabilities amid the auditing handle There are various security models for safeguarding the CCs (Cloud Client) information within the cloud. The TPA methodically analyzes the prove of compliance with set up security criteria within the connection between the CC and the Cloud Benefit Supplier (CSP). A novel strategy to create the record for a copy check, and utilize a modern methodology to create the key for the record encryption. In expansion, the client as it were must perform lightweight computation to produce information authenticators, verify cloud information keenness, and recover the information from the cloud.

Learning From Others Without Sacrificing Privacy: Simulation Comparing Centralized and Federated Machine Learning on Mobile Health Data.

BackgroundThe use of wearables facilitates data collection at a previously unobtainable scale, enabling the construction of complex predictive models with the potential to improve health. However, the highly personal nature of these data requires strong privacy protection against data breaches and the use of data in a way that users do not intend. One method to protect user privacy while taking advantage of sharing data across users is federated learning, a technique that allows a machine learning model to be trained using data from all users while only storing a user’s data on that user’s device. By keeping data on users’ devices, federated learning protects users’ private data from data leaks and breaches on the researcher’s central server and provides users with more control over how and when their data are used. However, there are few rigorous studies on the effectiveness of federated learning in the mobile health (mHealth) domain. ObjectiveWe review federated learning and assess whether it can be useful in the mHealth field, especially for addressing common mHealth challenges such as privacy concerns and user heterogeneity. The aims of this study are to describe federated learning in an mHealth context, apply a simulation of federated learning to an mHealth data set, and compare the performance of federated learning with the performance of other predictive models. MethodsWe applied a simulation of federated learning to predict the affective state of 15 subjects using physiological and motion data collected from a chest-worn device for approximately 36 minutes. We compared the results from this federated model with those from a centralized or server model and with the results from training individual models for each subject.ResultsIn a 3-class classification problem using physiological and motion data to predict whether the subject was undertaking a neutral, amusing, or stressful task, the federated model achieved 92.8% accuracy on average, the server model achieved 93.2% accuracy on average, and the individual model achieved 90.2% accuracy on average. ConclusionsOur findings support the potential for using federated learning in mHealth. The results showed that the federated model performed better than a model trained separately on each individual and nearly as well as the server model. As federated learning offers more privacy than a server model, it may be a valuable option for designing sensitive data collection methods.

SPEED: secure, PrivatE, and efficient deep learning

We introduce a deep learning framework able to deal with strong privacy constraints. Based on collaborative learning, differential privacy and homomorphic encryption, the proposed approach advances state-of-the-art of private deep learning against a wider range of threats, in particular the honest-but-curious server assumption. We address threats from both the aggregation server, the global model and potentially colluding data holders. Building upon distributed differential privacy and a homomorphic argmax operator, our method is specifically designed to maintain low communication loads and efficiency. The proposed method is supported by carefully crafted theoretical results. We provide differential privacy guarantees from the point of view of any entity having access to the final model, including colluding data holders, as a function of the ratio of data holders who kept their noise secret. This makes our method practical to real-life scenarios where data holders do not trust any third party to process their datasets nor the other data holders. Crucially the computational burden of the approach is maintained reasonable, and, to the best of our knowledge, our framework is the first one to be efficient enough to investigate deep learning applications while addressing such a large scope of threats. To assess the practical usability of our framework, experiments have been carried out on image datasets in a classification context. We present numerical results that show that the learning procedure is both accurate and private.

Impact of data correlation on privacy budget allocation in continuous publication of location statistics

Continuous publication of statistics collected from various location-based applications may compromise users’ privacy as the statistics could be procured from users’ private data. Differential Privacy (DP) is a new privacy notion that offers a strong privacy guarantee to all users who participate in the statistics. However, the existing DP mechanism for continuous publication of location statistics provides a privacy guarantee with the assumption that the data-points of users stream at consecutive timestamps are independent. In reality, users’ data-points may be temporally correlated, resulting in more privacy leakage due to an inadequate supply of privacy budget to the timestamps where the data-points are correlated. In this paper, we present a reformulated differential privacy definition to quantify the impact of temporal correlation on privacy leakage. Then, we introduce a privacy budget allocation method for allocating an adequate amount of privacy budget to each successive timestamps under the protection of differential privacy. Our solution adopts w-event privacy for continuously releasing statistics over infinite streams. The main idea is to check the dissimilarity between statistics at each timestamp and decide whether to publish current statistics or last release statistics. Finally, we evaluate the data utility of our proposed method by presenting experimental results for real and synthetic data sets.

Privacy-Preserving Streaming Truth Discovery in Crowdsourcing With Differential Privacy

Differential privacy (DP) has gained popularity in truth discovery recently due to its strong privacy guarantee. However, existing DP mechanisms for streaming data publication are not suitable for truth discovery as they fail to consider the different reliabilities of individuals, while the DP-based approaches for truth discovery are not suitable for streaming data because they ignore the correlations between truths over time. Directly applying these existing methods to streaming crowdsourced data would lead to low accuracy of the discovered truth. To solve this problem, in this paper, we propose an edge computing based privacy-preserving truth discovery mechanism, named PrivSTD, for streaming crowdsourced data to realize high accuracy of discovered truth while protecting the privacy of workers. Specifically, edge servers are introduced between the untrusted cloud server and workers to securely calculate the local truths and workers’ reliabilities. A truth-dependent budget recycle mechanism is proposed for each edge server to adaptively determine the perturbed timestamp and allocate the privacy budget according to the changing pattern of local truths. Besides, a reliability-based perturbation mechanism is proposed to reduce the perturbation magnitude on the basis of worker's reliability. We theoretical analyze the data utility and computation cost of PrivSTD, and prove that PrivSTD can satisfy <inline-formula><tex-math notation="LaTeX">$w$</tex-math></inline-formula> -event ( <inline-formula><tex-math notation="LaTeX">$\epsilon,\delta$</tex-math></inline-formula> )-differential privacy. Extensive experimental results on synthetic and real-world datasets demonstrate that PrivSTD achieves better utility than the state-of-the-art approaches.

Optimized and federated soft-impute for privacy-preserving tensor completion in cyber-physical-social systems

Cyber-physical-social systems (CPSSs) handle large-scale multi-source data in different application areas, and the collected data usually contain personal private information and uncompleted information, which are typically distributed in different locations. Tensor completion has been widely used for recovering the missing entries in scale multidimensional data, and has proven to be an effective method. Privacy-preserving tensor completion in CPSSs, however, faces challenging issues, such as scalability, scatter, and security. In this paper, we propose a privacy-preserving tensor completion method that uses the optimized federated soft-impute algorithm with a differentially private guarantee. Moreover, we theoretically analyzed the privacy guarantee and utility guarantee. We evaluated the proposed algorithms on both synthetic data and real-world data. The results show that our algorithm performed better and provided strong privacy protection under a federated learning framework. Our method significantly saved space and time for privacy-preserving tensor completion in a CPSS.

LF-GDPR: A Framework for Estimating Graph Metrics With Local Differential Privacy

Local differential privacy (LDP) is an emerging technique for privacy-preserving data collection without a trusted collector. Despite its strong privacy guarantee, LDP cannot be easily applied to real-world graph analysis tasks such as community detection and centrality analysis due to its high implementation complexity and low data utility. In this paper, we address these two issues by presenting LF-GDPR, the first LDP-enabled graph metric estimation framework for graph analysis. It collects two atomic graph metrics—the adjacency bit vector and node degree—from each node locally. LF-GDPR simplifies the job of implementing LDP-related steps (e.g., local perturbation, aggregation and calibration) for a graph metric estimation task by providing either a complete or a parameterized algorithm for each step. To address low data utility of LDP, it optimally allocates privacy budget between the two atomic metrics during data collection. To demonstrate the usage of LF-GDPR, we show use cases on two common graph analysis tasks, namely, clustering coefficient estimation and community detection. The privacy and utility achieved by LF-GDPR are verified through theoretical analysis and extensive experimental results.

SecTEP: Enabling secure tender evaluation with sealed prices and quality evaluation in procurement bidding systems over blockchain

Numerous methods have been proposed in the past few years to perform tender evaluation in procurement bidding systems, such as cloud storage procurement bidding systems. However, most of the proposed approaches focus only on the bidding price comparison and bidding efficiency while neglecting supplier quality evaluation and bidding privacy. To the best of our knowledge, the existing studies on tender evaluation in procurement bidding systems either provide insufficient privacy protection or are only concerned with bidding prices. In this paper, for the first time, we propose SecTEP, a Secure Tender Evaluation method with sealed prices and quality evaluation in Procurement bidding systems over blockchain. SecTEP considers not only the bidding price but also the supplier’s quality, while protecting the privacy of the bidding and evaluation results. SecTEP is constructed using delicately designed cryptographic tools that perform bidding price validation, bidding price comparison, quality score aggregation, and winner declaration over encrypted values. Moreover, we customize a finer-grained algorithm for bidding price comparison to support price tie identification. Finally, we employ the blockchain technology to ensure a transparent, tamper-proof, and traceable implementation of SecTEP. Theoretical security analysis and performance evaluation ensure that SecTEP maintains a strong privacy of bidding prices while providing quality evaluation services for suppliers. Experimental results further demonstrate the validity of the theoretical analysis as well as the practical application of SecTEP in the real world.

Distributed L-diversity using spark-based algorithm for large resource description frameworks data

Privacy protection issues for resource description frameworks (RDFs) have emerged over the use of public government open data and the healthcare data of individuals. As these data may include personal information, they must undergo a de-identification process that deletes or replaces parts of the original data. To enable these protections, a method has been developed to apply k-anonymization to RDF data. However, sensitive RDF information anonymized using k-anonymization is not completely secure and is vulnerable to attacks. In this paper, we propose an l-diversity anatomy de-identification method that can overcome the limitations of k-anonymity and guarantee stronger privacy protection than k-anonymization. Further, as this data anonymization process is computationally time-intensive, we use Spark distributed computing to provide rapid de-identification to enhance its utility. We also propose l-diversity preservation for dynamically evolving RDF datasets. Experimental results show that our proposed distributed l-diversity algorithm processes the data more efficiently than conventional approaches.

Differentially private approximate aggregation based on feature selection

Privacy-preserving data aggregation is an important problem that has attracted extensive study. The state-of-the-art techniques for solving this problem is differential privacy, which offers a strong privacy guarantee without making strong assumptions about the attacker. However, existing solutions cannot effectively query data aggregation from high-dimensional datasets under differential privacy guarantee. Particularly, when the input dataset contains large number of dimensions, existing solutions must inject large scale of noise into returned aggregates. To address the above issue, this paper proposes an algorithm for querying differentially private approximate aggregates from high-dimensional datasets. Given a dataset D, our algorithm first develops a $$\varepsilon '$$ -differentially private feature selection method that is based on a data sampling process over a kd-tree, which allows us to obtain a differentially private low-dimensional dataset with representative instances. After that, our algorithm samples independent samples from the kd-tree aiming at obtaining $$(\alpha ', \delta ')$$ -approximate aggregates. Finally, a model is proposed to determine the relevance between privacy and utility budgets such that the final aggregate still satisfies the accuracy requirements specified by data consumers. Intuitively, the proposed algorithm circumvents the dilemma of both dimensionality and the height threshold of kd-tree, as it samples a low-dimensional dataset S and queries aggregates from S, instead of the kd-tree. Satisfying user-specified privacy and utility budgets after multiple-stages approximation is significantly challenging, and we presents a novel model to determine the parameters’ relevance.

Combining simple motion measurement, lean analysis technique and historical data review for countering negative labor cost variance: A case study

Negative labor cost variance (NLCV) is an important problem in many manufacturing companies today. NLCV refers to the situation that expected or standard costs are less than actual labor costs in production. Management of NLCV, including the identification of causes for NLCV and the elimination or significant reduction of NLCV, is the topic discussed in this paper. The question studied in this paper is thus: what is an effective methodology in the environment of strong privacy protection to identify causes for NLCV and to significantly reduce it? The study presented in this paper proposed a methodology by combining a simple motion measurement (stopwatch), lean analysis techniques, and historical data review to study the NLCV problem. A case study was taken on a particular company called ABC to test the effectiveness of this methodology. Specifically, the result of the study revealed that (1) the employees in ABC waited for one reason or the other for almost 5 h (idle time) in a 16-h daily operation period (2 shifts running at 8 h each), which accounts for 32% of the total productive time, and (2) the elimination of the waiting time or idle time over the years concerned could account for 83% of all identified wastes in ABC. Through this case study, the effectiveness of the proposed methodology was demonstrated and the applicability of the proposed methodology was also implied.

A Proposal for a Canadian CBDC

Undoubtedly inspired by recent advances in technology-driven payment systems such as mobile payment systems, cryptocurrencies, and blockchain technologies, recent years have seen central banks worldwide explore the possibility of issuing digital forms of fiat money called central bank digital currencies or CBDCs. A thoughtfully designed CBDC can help satisfy numerous policy objectives, improve economic efficiency and inclusivity, and serve as a platform for economic innovation. However, the vast CBDC design landscape, coupled with its potential to massively disrupt the financial system and broader economy, warrants caution, calling for a careful and methodical analysis of various designs' strengths, weaknesses, and risk profiles. At this time, the Bank of Canada (BoC) has not committed to issuing a CBDC; nevertheless, it does rank among the more than 80% of central banks globally who, according to a recent survey by the Bank for International Settlements (BIS), are at least contingency planning for the eventuality of doing so. This report details and analyzes the authors' vision for a hypothetical BoC-issued retail CBDC for use in the Canadian context, taking into account both, the `business case' for its adoption from the perspective of BoC, policymakers, the financial services industry, and the Canadian economy more generally and how its widespread adoption would impact ordinary Canadians. The design considered in this report leverages a mix of distributed ledger technologies (DLTs} and electronic cash (`e-cash') schemes with advanced cryptographic primitives. The confluence of these building blocks results in a scalable, resilient, privacy-centric, and universally accessible design that strives to bring added value (a Pareto improvement) for all stakeholders in Canada. In light of the abundance of CBDC designs in circulation, this report emphasizes aspects and implications of the design specifically tailored for Canada, such as ensuring universal access for remote communities and strong privacy protections consistent with Canada's role as a world leader in civil liberties and human rights. Likewise, some core aspects of the proposed architecture reflect characteristics of Canadian law and the Canadian financial system, which may differ substantially from other countries.

Applications of Differential Privacy in Social Network Analysis: A Survey

Differential privacy provides strong privacy preservation guarantee in information sharing. As social network analysis has been enjoying many applications, it opens a new arena for applications of differential privacy. This article presents a comprehensive survey connecting the basic principles of differential privacy and applications in social network analysis. We concisely review the foundations of differential privacy and the major variants. Then, we discuss how differential privacy is applied to social network analysis, including privacy attacks in social networks, models of differential privacy in social network analysis, and a series of popular tasks, such as analyzing degree distribution, counting subgraphs and assigning weights to edges. We also discuss a series of challenges for future work.

Secure and location privacy in geographical data with electronic codebook mode-advanced encryption standard

Location-Based Service (LBS) is considered as one of the utmost encouraging as well as new ways of convergence technologies ensuing in the development of numerous fields together with database systems, mobile communication, internet technology and positioning systems. Even though being introduced in the mid 1990s, only contemporary LBS has achieved an efficient intense study owing to its commercial and scientific influence. As the LBS is associated to the user's location that can be preferred to track the actions of user, a strong privacy concern is elevated. To maintain the user's position, different intelligent works that are introduced with numerous challenges are still expecting solutions. To solve these issues, this paper proposes an encryption technique for improving the security of the LBS system named as Electronic Codebook Mode-Advanced Encryption Standard (ECBM-AES). The key purpose of this study is to offer security in addition to location privacy against the attackers. The cryptographic approach uses two veriers, and the claimed region could be in any intermission amongst the two veriers. The results show that the proposed technique provides better key generation ratio and network size, Packet Delivery Ratio (PDR), security and higher location privacy compared with the existing techniques.

Analysis of topics and characteristics of user reviews on different online psychological counseling methods

BackgroundPsychological support is available more widely supported by emerging technologies as an addition to face-to-face consultations, more and more people are accessing psychological support using online resources. ObjectiveThis research provides insights into the perception of the key factors that affect the effectiveness of different online psychological counseling methods through the user reviews of four online psychological counseling modes and the tendency to choose the different counseling methods for users with different psychological problems. MethodsUsing topic modeling analysis, Gooseeker content analysis, and the TextMind Chinese psychological analysis system, we analyzed 163,377 online reviews from 2,375 psychological consultants extracted from a leading online psychological consultation platform in China. Results(1) Telephone counseling gains the most preferences among users. Text counseling has strong privacy protection. Video and face-to-face consultations are more authentic and comprehensive. (2) Parent-child education consultation users are more likely to choose face-to-face consultation, patients with common mental illnesses are more inclined to choose online counseling methods than offline consultation, career planning consultation clients prefer video consultation, and text counseling is more consistent with the periodical characteristics of relationship counseling. ConclusionThe research examined user reviews and used content analysis to understand patients' views on the effectiveness of online counseling methods, which supplement the current research gap through innovation in research methods.

Privacy preserving classification over differentially private data

AbstractPrivacy preserving data classification is an important research area in data mining field. The goal of a privacy preserving classification algorithm is to protect the sensitive information as much as possible, while providing satisfactory classification accuracy. Differential privacy is a strong privacy guarantee that enables privacy of sensitive data stored in a database by determining the ratio of sensitive information leakage with respect to an ɛ parameter. In this study, our aim is to investigate the classification performance of the state‐of‐the‐art classification algorithms such as C4.5, Naïve Bayes, One Rule, Bayesian Networks, PART, Ripper, K*, IBk, and Random tree for performing privacy preserving classification. To preserve privacy of the data to be classified, we applied input perturbation technique coming from differential privacy, and observed the relationship between the ɛ parameter values and accuracy of the classifiers. To our best knowledge, this article is the first study that analyzes the performances of the well‐known classification algorithms over differentially private data, and discovers which datasets are more suitable for privacy preserving classification when input perturbation is applied to provide data privacy. The classification algorithms are compared by using the differentially private versions of the well‐known datasets from the UCI repository. According to the experimental results, we observed that, as ɛ parameter value increases, better classification accuracies are achieved with lower privacy levels. When the classifiers are compared, Naïve Bayes classifier is the most successful method. The ɛ parameter should be greater than or equal to 2 (i.e., ɛ ≥2) to achieve cloud server is malicious and untrusted, sensitive data will satisfactory classification accuracies.This article is categorized under: Commercial, Legal, and Ethical Issues &gt; Security and Privacy Technologies &gt; Classification

Refinement Orders for Quantitative Information Flow and Differential Privacy

Quantitative Information Flow (QIF) and Differential Privacy (DP) are both concerned with the protection of sensitive information, but they are rather different approaches. In particular, QIF considers the expected probability of a successful attack, while DP (in both its standard and local versions) is a max-case measure, in the sense that it is compromised by the existence of a possible attack, regardless of its probability. Comparing systems is a fundamental task in these areas: one wishes to guarantee that replacing a system A by a system B is a safe operation that is the privacy of B is no worse than that of A. In QIF, a refinement order provides strong such guarantees, while, in DP, mechanisms are typically compared w.r.t. the privacy parameter ε in their definition. In this paper, we explore a variety of refinement orders, inspired by the one of QIF, providing precise guarantees for max-case leakage. We study simple structural ways of characterising them, the relation between them, efficient methods for verifying them and their lattice properties. Moreover, we apply these orders in the task of comparing DP mechanisms, raising the question of whether the order based on ε provides strong privacy guarantees. We show that, while it is often the case for mechanisms of the same “family” (geometric, randomised response, etc.), it rarely holds across different families.

High Contrast Ratio FFS-based LCD Switchable to a Stronger Privacy Mode

High Contrast Ratio FFS-based LCD Switchable to a Stronger Privacy Mode