Technology that enhances without inhibiting learning

Technology supported information sharing could be argued to both enhance and inhibit learning. However, social and affective issues that motivate learners' technology interactions are often overlooked. Are learners avoiding valuable learning applications because of privacy fears and trust issues? Will inaccurate technology assumptions and awareness inhibit information sharing? Do learners need control over technology enhanced safe creative spaces or can they be motivated to overcome badly designed systems because sharing is 'valuable' or 'fun'. This presentation details a model of privacy and trust issues that can be used to enhance elearning. Several OU case-studies of multimedia, mobile and elearning applications (conducted within IET, KMI and the Open CETL) are evaluated using this model. The model helps to identify trade-offs that learners make for technology enhanced or inhibited learning. Theories of control, identity, information sensitivity and re-use are discussed within the context of these elearning examples

A roadmap towards improving managed security services from a privacy perspective

Published version of an article in the journal: Ethics and Information Technology. Also available from the publisher at: http://dx.doi.org/10.1007/s10676-014-9348-3This paper proposes a roadmap for how privacy leakages from outsourced managed security services using intrusion detection systems can be controlled. The paper first analyses the risk of leaking private or confidential information from signature-based intrusion detection systems. It then discusses how the situation can be improved by developing adequate privacy enforcement methods and privacy leakage metrics in order to control and reduce the leakage of private and confidential information over time. Such metrics should allow for quantifying how much information that is leaking, where these information leakages are, as well as showing what these leakages mean. This includes adding enforcement mechanisms ensuring that operation on sensitive information is transparent and auditable. The data controller or external quality assurance organisations can then verify or certify that the security operation operates in a privacy friendly manner. The roadmap furthermore outlines how privacy-enhanced intrusion detection systems should be implemented by initially providing privacy-enhanced alarm handling and then gradually extending support for privacy enhancing operation to other areas like digital forensics, exchange of threat information and big data analytics based attack detection

Quantum Private Information Retrieval from Coded Storage Systems

In the era of extensive data growth, robust and efficient mechanisms are needed to store and manage vast amounts of digital information, such as Data Storage Systems (DSSs). Concurrently, privacy concerns have arisen, leading to the development of techniques like Private Information Retrieval (PIR) to enable data access while preserving privacy. A PIR protocol allows users to retrieve information from a database without revealing the specifics of their query or the data they are accessing. With the advent of quantum computing, researchers have explored the potential of using quantum systems to enhance privacy in information retrieval. In a Quantum Private Information Retrieval (QPIR) protocol, a user can retrieve information from a database by downloading quantum systems from multiple servers, while ensuring that the servers remain oblivious to the specific information being accessed. This scenario offers a unique advantage by leveraging the inherent properties of quantum systems to provide enhanced privacy guarantees and improved communication rates compared to classical PIR protocols. In this thesis we consider the QPIR setting where the queries and the coded storage systems are classical, while the responses from the servers are quantum. This problem was treated by Song et al. for replicated storage and different collusion patterns. This thesis aims to develop QPIR protocols for coded storage by combining known classical PIR protocols with quantum communication algorithms, achieving enhanced privacy and communication costs. We consider different storage codes and robustness assumptions, and we prove that the achieved communication cost is always lower than the classical counterparts.Comment: This is the summary part of an article collection-based PhD thesi

Mind your step! : How profiling location reveals your identity - and how you prepare for it

Location-based services (LBS) are services that position your mobile phone to provide some context-based service for you. Some of these services – called ‘location tracking’ applications - need frequent updates of the current position to decide whether a service should be initiated. Thus, internet-based systems will continuously collect and process the location in relationship to a personal context of an identified customer. This paper will present the concept of location as part of a person’s identity. I will conceptualize location in information systems and relate it to concepts like privacy, geographical information systems and surveillance. The talk will present how the knowledge of a person's private life and identity can be enhanced with data mining technologies on location profiles and movement patterns. Finally, some first concepts about protecting location information

Enhanced privacy governance in Health Information Systems through business process modelling and HL7

© 2019 The Authors. Published by Elsevier B.V. Medical data privacy is nowadays an alarming issue thanks to the technological revolution witnessed in the medical field and the ease of data access and exchange leveraged by newly implemented Hospital Information Systems (HIS). In order to help protect patient data while offering them the required medical procedures, many computerized techniques could be made available to be implemented in HIS since an early stage of their design. Those techniques should be applied throughout the rolling of clinical pathways to preserve medical data privacy and security in order to enhance privacy governance within Hospitals. When considered as processes, and because of their complexity and multidisciplinary nature, clinical pathways should be modelled in a simple way paying attention to medical tasks and the underlining shared clinical data. It is important to highlight the data with higher protection and sensitivity level. These data characteristics will influence many governance and security decisions of each process. This work aims to present a methodology to model clinical pathway specifications for data driven clinical processes, distinguishing sensitive data from other data and identifying personal data protection principles and the Protected Health Information (PHI). In this context, we precise for each clinical task potentially involving data processing and sharing, the level of protection the data requires through the use of privacy tags and labels added to data elements predefined using the HL7 standard. This method of tagging would help mapping extracted data, classified into categories, to a set of privacy requirements as needed by the HIPAA legislation. Hence data protection and privacy governance are leveraged in a seamless and highly transparent way. The use of HL7 allowed better data discovery and parsing which facilitates the definition of medical data protection measures at a later stage

Advancing security information and event management frameworks in managed enterprises using geolocation

Includes bibliographical referencesSecurity Information and Event Management (SIEM) technology supports security threat detection and response through real-time and historical analysis of security events from a range of data sources. Through the retrieval of mass feedback from many components and security systems within a computing environment, SIEMs are able to correlate and analyse events with a view to incident detection. The hypothesis of this study is that existing Security Information and Event Management techniques and solutions can be complemented by location-based information provided by feeder systems. In addition, and associated with the introduction of location information, it is hypothesised that privacy-enforcing procedures on geolocation data in SIEMs and meta- systems alike are necessary and enforceable. The method for the study was to augment a SIEM, established for the collection of events in an enterprise service management environment, with geo-location data. Through introducing the location dimension, it was possible to expand the correlation rules of the SIEM with location attributes and to see how this improved security confidence. An important co-consideration is the effect on privacy, where location information of an individual or system is propagated to a SIEM. With a theoretical consideration of the current privacy directives and regulations (specifically as promulgated in the European Union), privacy supporting techniques are introduced to diminish the accuracy of the location information - while still enabling enhanced security analysis. In the context of a European Union FP7 project relating to next generation SIEMs, the results of this work have been implemented based on systems, data, techniques and resilient features of the MASSIF project. In particular, AlienVault has been used as a platform for augmentation of a SIEM and an event set of several million events, collected over a three month period, have formed the basis for the implementation and experimentation. A "brute-force attack" misuse case scenario was selected to highlight the benefits of geolocation information as an enhancement to SIEM detection (and false-positive prevention). With respect to privacy, a privacy model is introduced for SIEM frameworks. This model utilises existing privacy legislation, that is most stringent in terms of privacy, as a basis. An analysis of the implementation and testing is conducted, focusing equally on data security and privacy, that is, assessing location-based information in enhancing SIEM capability in advanced security detection, and, determining if privacy-enforcing procedures on geolocation in SIEMs and other meta-systems are achievable and enforceable. Opportunities for geolocation enhancing various security techniques are considered, specifically for solving misuse cases identified as existing problems in enterprise environments. In summary, the research shows that additional security confidence and insight can be achieved through the augmentation of SIEM event information with geo-location information. Through the use of spatial cloaking it is also possible to incorporate location information without com- promising individual privacy. Overall the research reveals that there are significant benefits for SIEMs to make use of geo-location in their analysis calculations, and that this can be effectively conducted in ways which are acceptable to privacy considerations when considered against prevailing privacy legislation and guidelines