11,174 research outputs found
Exploratory Study of the Privacy Extension for System Theoretic Process Analysis (STPA-Priv) to elicit Privacy Risks in eHealth
Context: System Theoretic Process Analysis for Privacy (STPA-Priv) is a novel
privacy risk elicitation method using a top down approach. It has not gotten
very much attention but may offer a convenient structured approach and
generation of additional artifacts compared to other methods. Aim: The aim of
this exploratory study is to find out what benefits the privacy risk
elicitation method STPA-Priv has and to explain how the method can be used.
Method: Therefore we apply STPA-Priv to a real world health scenario that
involves a smart glucose measurement device used by children. Different kinds
of data from the smart device including location data should be shared with the
parents, physicians, and urban planners. This makes it a sociotechnical system
that offers adequate and complex privacy risks to be found. Results: We find
out that STPA-Priv is a structured method for privacy analysis and finds
complex privacy risks. The method is supported by a tool called XSTAMPP which
makes the analysis and its results more profound. Additionally, we learn that
an iterative application of the steps might be necessary to find more privacy
risks when more information about the system is available later. Conclusions:
STPA-Priv helps to identify complex privacy risks that are derived from
sociotechnical interactions in a system. It also outputs privacy constraints
that are to be enforced by the system to ensure privacy.Comment: author's post-prin
A Middleware for the Internet of Things
The Internet of Things (IoT) connects everyday objects including a vast array
of sensors, actuators, and smart devices, referred to as things to the
Internet, in an intelligent and pervasive fashion. This connectivity gives rise
to the possibility of using the tracking capabilities of things to impinge on
the location privacy of users. Most of the existing management and location
privacy protection solutions do not consider the low-cost and low-power
requirements of things, or, they do not account for the heterogeneity,
scalability, or autonomy of communications supported in the IoT. Moreover,
these traditional solutions do not consider the case where a user wishes to
control the granularity of the disclosed information based on the context of
their use (e.g. based on the time or the current location of the user). To fill
this gap, a middleware, referred to as the Internet of Things Management
Platform (IoT-MP) is proposed in this paper.Comment: 20 pages, International Journal of Computer Networks & Communications
(IJCNC) Vol.8, No.2, March 201
Potential mass surveillance and privacy violations in proximity-based social applications
Proximity-based social applications let users interact with people that are
currently close to them, by revealing some information about their preferences
and whereabouts. This information is acquired through passive geo-localisation
and used to build a sense of serendipitous discovery of people, places and
interests. Unfortunately, while this class of applications opens different
interactions possibilities for people in urban settings, obtaining access to
certain identity information could lead a possible privacy attacker to identify
and follow a user in their movements in a specific period of time. The same
information shared through the platform could also help an attacker to link the
victim's online profiles to physical identities. We analyse a set of popular
dating application that shares users relative distances within a certain radius
and show how, by using the information shared on these platforms, it is
possible to formalise a multilateration attack, able to identify the user
actual position. The same attack can also be used to follow a user in all their
movements within a certain period of time, therefore identifying their habits
and Points of Interest across the city. Furthermore we introduce a social
attack which uses common Facebook likes to profile a person and finally
identify their real identity
Semi-autonomous, context-aware, agent using behaviour modelling and reputation systems to authorize data operation in the Internet of Things
In this paper we address the issue of gathering the "informed consent" of an
end user in the Internet of Things. We start by evaluating the legal importance
and some of the problems linked with this notion of informed consent in the
specific context of the Internet of Things. From this assessment we propose an
approach based on a semi-autonomous, rule based agent that centralize all
authorization decisions on the personal data of a user and that is able to take
decision on his behalf. We complete this initial agent by integrating
context-awareness, behavior modeling and community based reputation system in
the algorithm of the agent. The resulting system is a "smart" application, the
"privacy butler" that can handle data operations on behalf of the end-user
while keeping the user in control. We finally discuss some of the potential
problems and improvements of the system.Comment: This work is currently supported by the BUTLER Project co-financed
under the 7th framework program of the European Commission. published in
Internet of Things (WF-IoT), 2014 IEEE World Forum, 6-8 March 2014, Seoul,
P411-416, DOI: 10.1109/WF-IoT.2014.6803201, INSPEC: 1425565
- …