User's Private Information Research Articles

Collaborative privacy management

The landscape of the World Wide Web with all its versatile services heavily relies on the disclosure of private user information. Unfortunately, the growing amount of personal data collected by service providers poses a significant privacy threat for Internet users. Targeting growing privacy concerns of users, privacy-enhancing technologies emerged. One goal of these technologies is the provision of tools that facilitate a more informative decision about personal data disclosures. A famous PET representative is the PRIME project that aims for a holistic privacy-enhancing identity management system. However, approaches like the PRIME privacy architecture require service providers to change their server infrastructure and add specific privacy-enhancing components. In the near future, service providers are not expected to alter internal processes. Addressing the dependency on service providers, this paper introduces a user-centric privacy architecture that enables the provider-independent protection of personal data. A central component of the proposed privacy infrastructure is an online privacy community, which facilitates the open exchange of privacy-related information about service providers. We characterize the benefits and the potentials of our proposed solution and evaluate a prototypical implementation.

Internet and Online Information Privacy: An Exploratory Study of Preteens and Early Teens

Information security and privacy on the internet are critical issues in our society. In this research, we examine factors that influence Internet users' private-information-sharing behavior. Based on a survey of 285 preteens and early teens, who are among the most vulnerable groups on the Web, this study provides a research framework that explains an internet user's information privacy protection behavior. According to our study results, internet users' information privacy behaviors are affected by two significant factors: (1) users' perceived importance of information privacy and (2) information privacy self-efficacy. The study also found that users believe in the value of online information privacy and that information privacy protection behavior varies by gender. Our findings indicate that educational opportunities regarding internet privacy and computer security as well as concerns from other reference groups (e.g., peer, teacher, and parents) play an important role in positively affecting the Internet users' protective behavior regarding online privacy.

Publication and Protection of Sensitive Site Information in a Grid Infrastructure

In order to create a successful grid infrastructure, sites and resource providers must be able to publish information about their underlying resources and services. This information enables users and virtual organizations to make intelligent decisions about resource selection and scheduling, and facilitates accounting and troubleshooting services within the grid. However, such an outbound stream may include data deemed sensitive by a resource-providing site, exposing potential security vulnerabilities or private user information. This study analyzes the various vectors of information being published from sites to grid infrastructures. In particular, it examines the data being published and collected in the Open Science Grid, including resource selection, monitoring, accounting, troubleshooting, logging and site verification data. We analyze the risks and potential threat models posed by the publication and collection of such data. We also offer some recommendations and best practices for sites and grid infrastructures to manage and protect sensitive data.

Secure vehicular communication systems: design and architecture

Significant developments have taken place over the past few years in the area of vehicular communication (VC) systems. Now, it is well understood in the community that security and protection of private user information are a prerequisite for the deployment of the technology. This is so, precisely because the benefits of VC systems, with the mission to enhance transportation safety and efficiency, are at stake. Without the integration of strong and practical security and privacy enhancing mechanisms, VC systems could be disrupted or disabled, even by relatively unsophisticated attackers. We address this problem within the SeVeCom project, having developed a security architecture that provides a comprehensive and practical solution. We present our results in a set of two papers in this issue. In this first one, we analyze threats and types of adversaries, we identify security and privacy requirements, and we present a spectrum of mechanisms to secure VC systems. We provide a solution that can be quickly adopted and deployed. In the second paper, we present our progress towards the implementation of our architecture and results on the performance of the secure VC system, along with a discussion of upcoming research challenges and our related current results.

A Delegation Model based on Agent in Distributed Systems

Web services are the new building block of today's Internet, and provides interoperability among heterogeneous distributed systems. Recently in web services environment, security has become one of the most critical issues. The hackers attack one of fragile point and can misuse legitimate user privilege because all of the connected devices provide services for the user control and monitoring in real time. Also, the users of web services must temporarily delegate some or all of their rights to agents in order to perform actions on their behalf. This fact risks the exposure of user privacy information. In this paper, we propose secure delegation model based on SAML that provides confidentiality and integrity about the user information in distributed systems. In order to support privacy protection, service confidentiality, and assertion integrity, encryption and a digital signature mechanism is deployed. We build web service management server based on XACML, in order to manage services and policies of web service providers.

Trust, privacy, and legal protection in the use of software with surreptitiously installed operations: An empirical evaluation

The class of software which is "surreptitiously installed on a user's computer and monitors a user's activity and reports back to a third party on that behavior" is referred to as spyware "(Stafford and Urbaczewski in Communications of the AIS 14:291---306, 2004)". It is a strategic imperative that software vendors, who either embed surreptitious data collection and other operations in legitimate software applications or whose software is unwittingly used as a delivery vehicle for surreptitious operations, understand users' perceptions of trust, privacy, and legal protection of such software to remain competitive. This paper develops and tests a research model to explore application software users' perceptions in the use of software with embedded surreptitious operations. An experiment was undertaken to examine whether the presence of spyware in application software impacts users' perceptions and beliefs about trustworthiness of the application software, privacy control of the software vendor, United States legal protection, and overall trust of the software vendor. The results indicate users of software with spyware, versus users of software without spyware, have lower trust perceptions of a software vendor. Further examination of trustworthiness as a multi-dimensional construct reveals a software vendor's competence in appropriately using private user information collected and the user's belief that the vendor will abide by acceptable principles in information exchange are important influences in gaining users' overall trust in a vendor. User trust in software utilization is critical for a software vendor's success because without it, users may avoid a vendor's software should the presence of spyware be discovered. Software vendors should respond to the strategic necessity to gain users' trust. Vendors must institute proactive and protective measures to demonstrate that their software should be trusted. These protections could take the form of technological approaches or government legislation, or both.

Pricing Computer Services Under Alternative Control Structures: Tradeoffs and Trends

This paper extends the analysis of the long-run pricing and capacity decision problem for shared computer services by Dewan and Mendelson (1990) and makes two further contributions. First, we show that simple marginal capacity cost pricing is often optimal in the absence of private user information, and it outperforms cost recovery and profit center pricing methods. Second, we provide insights into the implications of declining computing costs on the tradeoff between capacity costs and user time. In equilibrium, expected user delay costs are bounded by capacity costs due to the substitution of cheaper information processing capacity for valuable user time.