ipshield: A Framework For Enforcing Context-Aware Privacy

Size: px

Start display at page:

Download "ipshield: A Framework For Enforcing Context-Aware Privacy"

Richard McDowell
5 years ago
Views:

1 ipshield: A Framework For Enforcing Context-Aware Privacy Supriyo Chakraborty, Chenguang Shen, Kasturi Rangan Raghavan, Yasser Shoukry, Matt Millar, Mani Srivastava

2 2 From sensor data to inferences Sensor Data

3 2 From sensor data to inferences Apps Sensor Data

4 2 From sensor data to inferences Apps Inferences Utility Providing Fitness mhealth Lifelogging Phone operation Sensor Data

5 2 From sensor data to inferences Apps Inferences Utility Providing Fitness mhealth Lifelogging Phone operation Sensor Data Sensitive Location Password Media habits Physiological habits

6 3 From sensor data to inferences Apps Inferences Utility Providing Fitness mhealth Lifelogging Phone operation Sensitive Sensor Data Location Password Media habits Physiological habits

7 3 From sensor data to inferences Apps Inferences Utility Providing Fitness mhealth Lifelogging Phone operation Sensitive Sensor Data Location Password Media habits Physiological habits

8 3 From sensor data to inferences Apps Inferences Utility Providing Fitness mhealth Lifelogging Phone operation Sensitive Sensor Data Location Password Media habits Physiological habits

9 3 From sensor data to inferences Apps Inferences Utility Providing Fitness mhealth Lifelogging Phone operation Sensitive Sensor Data Location Password Media habits Physiological habits

10 4 Protecting inference privacy while providing utility Apps Inferences Utility Providing Fitness mhealth Lifelogging Phone operation Whitelist Sensitive Sensor Data Location Password Media habits Physiological habits Blacklist

11 4 Protecting inference privacy while providing utility Apps Inferences Utility Providing Fitness mhealth Lifelogging Phone operation Whitelist Inference firewall Sensitive Sensor Data Location Password Media habits Physiological habits Blacklist

12 4 Protecting inference privacy while providing utility Apps Inferences Utility Providing Fitness mhealth Lifelogging Phone operation Whitelist Inference firewall Sensitive Sensor Data Location Password Media habits Physiological habits Blacklist

13 Prior notions of privacy in databases Population Scale Database Sensor Data Capture Data Processing Sensor Data Capture Data Processing Sensor Data Capture Data Processing D := { P = personal identifiers, (name, ID) Q = quasi identifiers, (age, zip code) V = measurement values (sensor data)} 5

14 Prior notions of privacy in databases Population Scale Database Sensor Data Capture Data Processing 1. K-anonymity 2. L-Diversity 3. t-closeness Privacy M=<P,Q,V> inference = identity Information Recipient Sensor Data Capture Data Processing Sensor Data Capture Data Processing D := { P = personal identifiers, (name, ID) Q = quasi identifiers, (age, zip code) V = measurement values (sensor data)} 5

15 Prior notions of privacy in databases Population Scale Database Sensor Data Capture Data Processing 1. K-anonymity 2. L-Diversity 3. t-closeness Privacy M=<P,Q,V> inference = identity Information Recipient Sensor Data Capture Data Processing Privacy M=R(<P,Q,V>)+noise Sensor Data Capture Data Processing Information Recipient D := { P = personal identifiers, (name, ID) Q = quasi identifiers, (age, zip code) V = measurement values (sensor data)} Differential Privacy inference = membership 5

16 6 Prior notions of privacy in databases Sensor Data Capture Data Processing Aggregate Queries M:=<P, Q, V > Information Recipient Sensor Data Capture Data Processing Sharing an Individual s data Information Recipient

17 6 Prior notions of privacy in databases Privacy of Data (secrecy) Privacy of Identity (anonymity) Sensor Data Capture Data Processing Traditional Aggregate Queries M:=<P, Q, V > Information Recipient Sensor Data Capture Data Processing Sharing an Individual s data Information Recipient Privacy of Behavior

18 7 Controls provided by current systems are insufficient Android Manifest Binary Policies

19 7 Controls provided by current systems are insufficient pdroid Static Policies

20 7 Controls provided by current systems are insufficient ProtectMyPrivacy Share Random Data

21 8 Design requirements of ipshield Unrestricted Access Protected APIs

22 8 Design requirements of ipshield Combination of benign sensors can be used for privacy attack Sensor Monitoring Unrestricted Access Protected APIs

23 9 Design requirements of ipshield Sensor Monitoring GPS Network Accelerometer Microphone Light

24 9 Design requirements of ipshield Sensor Monitoring GPS Network Accelerometer Location Transportation Mode Password/PIN Privacy Abstraction Microphone Stress Light Media Watching

25 10 Design requirements of ipshield User Privacy Preferences Sensor Monitoring Privacy Abstraction Whitelist/Blacklist Translation Algorithms Privacy Rules on Sensors Rule Enforcement

26 10 Design requirements of ipshield User Privacy Preferences Sensor Monitoring Privacy Abstraction Whitelist/Blacklist Translation Algorithms Rule Recommender Privacy Rules on Sensors Rule Enforcement

27 10 Design requirements of ipshield User Privacy Preferences Sensor Monitoring Privacy Abstraction Whitelist/Blacklist Translation Algorithms Privacy Rules on Sensors Rule Recommender Manual Override (Rules) Rule Enforcement

28 10 Design requirements of ipshield User Privacy Preferences Sensor Monitoring Privacy Abstraction Whitelist/Blacklist Translation Algorithms Privacy Rules on Sensors Rule Recommender Manual Override (Rules) ipshield Rule Enforcement Rule Enforcement

29 Whitelist/Blacklist Rule Recommender Privacy rules on sensors

30 Recommender objective Generate a plan for context-aware obfuscation of sensor data depending on the prioritized whitelist and blacklist such that accuracy of whitelist is maximized and accuracy of blacklist is minimized. 12

31 Divide-and-conquer strategy Recommend a plan containing allow/deny rules for sensors depending on the prioritized whitelist and blacklist such that accuracy of whitelist is maximized and accuracy of blacklist is minimized. 13

accuracy of whitelist is maximized and accuracy of blacklist is minimized.

32 Divide-and-conquer strategy Recommend a plan containing allow/deny rules for sensors depending on the prioritized whitelist and blacklist such that accuracy of whitelist is maximized and accuracy of blacklist is minimized. + Support manual override/configuration of fine-grained context-aware rules 13

33 Elements of the problem: accuracy 14

34 14 Elements of the problem: accuracy Activity Location OnScreen Taps Inference Database (A) GPS+Acc+Gyro 95% 97% 80% GPS+WiFi 83.1% 97% 0% GPS+GSM 81.7% 98.2% 0% GSM+WiFi 72.9% 94.03% 0%

35 14 Elements of the problem: accuracy Activity Location OnScreen Taps Inference Database (A) GPS+Acc+Gyro 95% 97% 80% Sensor Combination GPS+WiFi 83.1% 97% 0% GPS+GSM 81.7% 98.2% 0% GSM+WiFi 72.9% 94.03% 0%

36 14 Elements of the problem: accuracy Activity Inference Location Type OnScreen Taps Inference Database (A) GPS+Acc+Gyro 95% 97% 80% Sensor Combination GPS+WiFi 83.1% 97% 0% GPS+GSM 81.7% 98.2% 0% GSM+WiFi 72.9% 94.03% 0%

37 14 Elements of the problem: accuracy Activity Inference Location Type OnScreen Taps Inference Database (A) GPS+Acc+Gyro 95% 97% 80% Sensor Combination Accuracy of Prediction GPS+WiFi 83.1% 97% 0% GPS+GSM 81.7% 98.2% 0% GSM+WiFi 72.9% 94.03% 0%

38 15 Elements of the problem: priority Priority (p) Priority =(p activity,p location,p tap ) priority = {10, 4, 10}

39 15 Elements of the problem: priority Priority (p) Priority =(p activity,p location,p tap ) priority = {10, 4, 10} Whitelisted inferences priority allow whitelisted inferences Blacklisted inferences priority block blacklisted inferences

40 16 Rule recommender in ipshield X max 22 N l2w A(,l)2 p l X l2b A(,l)2 p l s.t. X l2b,p l =p max A(,l)=0 W =whitelist,b = blacklist, p l = priority, and = Sensor combination

41 16 Rule recommender in ipshield X max 22 N l2w A(,l)2 p l X l2b A(,l)2 p l s.t. X l2b,p l =p max A(,l)=0 W =whitelist,b = blacklist, p l = priority, and = Sensor combination Over all sensor combinations

42 16 Rule recommender in ipshield X max 22 N l2w A(,l)2 p l X l2b A(,l)2 p l s.t. X l2b,p l =p max A(,l)=0 W =whitelist,b = blacklist, p l = priority, and = Sensor combination Over all sensor combinations maximize accuracy of prioritized whitelist and

43 16 Rule recommender in ipshield X max 22 N l2w A(,l)2 p l X l2b A(,l)2 p l s.t. X l2b,p l =p max A(,l)=0 W =whitelist,b = blacklist, p l = priority, and = Sensor combination Over all sensor combinations maximize accuracy of prioritized whitelist and minimize accuracy of prioritized blacklist

44 16 Rule recommender in ipshield X max 22 N l2w A(,l)2 p l X l2b A(,l)2 p l s.t. X l2b,p l =p max A(,l)=0 W =whitelist,b = blacklist, p l = priority, and = Sensor combination Over all sensor combinations maximize accuracy of prioritized whitelist and minimize accuracy of prioritized blacklist such that highest priority blacklists are always blocked.

45 17 Rule recommender at work Activity Location OnScreen Taps GPS+Acc+Gyro 95% 97% 80% GPS+WiFi 83.1% 97% 0% GPS+GSM 81.7% 98.2% 0% GSM+WiFi 72.9% 94.03% 0%

46 17 Rule recommender at work Activity Location OnScreen Taps GPS+Acc+Gyro 95% 97% 80% GPS+WiFi 83.1% 97% 0% GPS+GSM 81.7% 98.2% 0% GSM+WiFi 72.9% 94.03% 0%

47 17 Rule recommender at work Activity Location OnScreen Taps Priority1 {10, 4, 10} GPS+Acc+Gyro 95% 97% 80% 0 GPS+WiFi 83.1% 97% 0% GPS+GSM 81.7% 98.2% 0% GSM+WiFi 72.9% 94.03% 0%

48 17 Rule recommender at work Activity Location OnScreen Taps Priority1 {10, 4, 10} GPS+Acc+Gyro 95% 97% 80% 0 GPS+WiFi 83.1% 97% 0% Allow GPS+GSM 81.7% 98.2% 0% GSM+WiFi 72.9% 94.03% 0%

49 ipshield Monitoring Privacy Abstraction Rule Recommender Fine-grained Rules Enforcement Prototype implementation on Android

50 19 Sensor subsystem in android and data interception Third Party Apps Sensor Manager Sensor Data Android Framework Location Manager Sensor Data Sensor Service LocationManager Service System Server Android Native/Linux Kernel Hardware System Processes User Processes

51 19 Sensor subsystem in android and data interception Third Party Apps Sensor Manager Sensor Data Android Framework Location Manager Sensor Data Sensor Service LocationManager Service System Server Android Native/Linux Kernel Hardware System Processes User Processes

52 19 Sensor subsystem in android and data interception Third Party Apps Sensor Manager Sensor Data Android Framework Location Manager Sensor Data Sensor Service LocationManager Service System Server Android Native/Linux Kernel Hardware System Processes User Processes

53 19 Sensor subsystem in android and data interception Third Party Apps Sensor Manager Sensor Data Android Framework Location Manager Sensor Data Sensor Service LocationManager Service System Server Android Native/Linux Kernel Hardware System Processes User Processes

54 19 Sensor subsystem in android and data interception Third Party Apps Sensor Manager Android Framework Location Manager }App and Managers run as part of the same process Sensor Data Sensor Data Sensor Service LocationManager Service System Server Android Native/Linux Kernel Hardware System Processes User Processes

55 19 Sensor subsystem in android and data interception Sensor Manager Sensor Data Sensor Service Third Party Apps Android Framework System Server Android Native/Linux Kernel Hardware Location Manager Sensor Data LocationManager Service }App and Managers run as part of the same process } Services run in separate system owned processes System Processes User Processes

56 20 Implementing ipshield Trusted App part of ipshield Whitelist and Blacklist of inference ipshield Monitoring Privacy Abstraction Rule Recommender Sensor Manager Location Manager Fine-grained Rules Enforcement SensorService LocationManager Service System Processes System Server Native Runtime Hardware User Processes Trusted App (User Process)

57 20 Implementing ipshield Trusted App part of ipshield Whitelist and Blacklist of inference ipshield Semantic Firewall Configurator Monitoring Privacy Abstraction Rule Recommender Fine-grained Rules Sensor Manager FirewallConfig Manager Location Manager Enforcement SensorService FirewallConfig Service LocationManager Service System Server Native Runtime Hardware System Processes User Processes Trusted App (User Process)

58 20 Implementing ipshield Trusted App part of ipshield Whitelist and Blacklist of inference ipshield Semantic Firewall Configurator Monitoring Privacy Abstraction Inference Database Rule Recommender Fine-grained Rules Sensor Manager FirewallConfig Manager Location Manager Enforcement SensorService FirewallConfig Service LocationManager Service System Server Native Runtime Hardware System Processes User Processes Trusted App (User Process)

59 20 Implementing ipshield Trusted App part of ipshield Whitelist and Blacklist of inference ipshield Semantic Firewall Configurator Monitoring Privacy Abstraction Rule Recommender Inference Database Rule Recommender Fine-grained Rules Sensor Manager FirewallConfig Manager Location Manager Enforcement SensorService FirewallConfig Service LocationManager Service System Server Native Runtime Hardware System Processes User Processes Trusted App (User Process)

60 20 Implementing ipshield Trusted App part of ipshield Whitelist and Blacklist of inference ipshield Context Engine Direct Configurator Semantic Firewall Configurator Rule Recommender Inference Database Monitoring Privacy Abstraction Rule Recommender Fine-grained Rules Sensor Manager FirewallConfig Manager Location Manager Enforcement SensorService FirewallConfig Service LocationManager Service System Server Native Runtime Hardware System Processes User Processes Trusted App (User Process)

Fine-grained Rules Sensor Manager FirewallConfig Manager Location Manager Enforcement SensorService Obfuscator FirewallConfig

61 20 Implementing ipshield Trusted App part of ipshield Whitelist and Blacklist of inference ipshield Context Engine Direct Configurator Semantic Firewall Configurator Rule Recommender Inference Database Monitoring Privacy Abstraction Rule Recommender Fine-grained Rules Sensor Manager FirewallConfig Manager Location Manager Enforcement SensorService Obfuscator FirewallConfig Service System Server LocationManager Service Obfuscator Native Runtime Hardware System Processes User Processes Trusted App (User Process)

62 21 User interaction with ipshield ipshield Monitoring Privacy Abstraction Rule Recommender Fine-grained Rules

63 21 User interaction with ipshield ipshield Monitoring Privacy Abstraction Rule Recommender Fine-grained Rules

64 21 User interaction with ipshield ipshield Monitoring Privacy Abstraction Rule Recommender Suppress Fine-grained Rules

65 21 User interaction with ipshield ipshield Monitoring Privacy Abstraction Rule Recommender Fine-grained Rules

66 Feasibility of running ipshield on mobile platforms Time (in secs) time to load rules into memory time for the rules to take effect # rules 22

67 Feasibility of running ipshield on mobile platforms 0.1 SENSOR_DELAY_NORMAL, SENSOR_DELAY_UI Time (in secs) time to load rules into memory time for the rules to take effect # rules 22

68 Feasibility of running ipshield on mobile platforms 0.1 SENSOR_DELAY_NORMAL, SENSOR_DELAY_UI Time (in secs) SENSOR_DELAY _GAME time to load rules into memory time for the rules to take effect # rules 22

69 Feasibility of running ipshield on mobile platforms 0.1 SENSOR_DELAY_NORMAL, SENSOR_DELAY_UI Time (in secs) SENSOR_DELAY _GAME SENSOR_DELAY _FASTEST time to load rules into memory time for the rules to take effect # rules 22

70 23 Feasibility of running ipshield on mobile platforms 26.7 Memory (in MB) AOSP Passthrough Constant Perturb Suppress

71 23 Feasibility of running ipshield on mobile platforms 26.7 Memory (in MB) AOSP Passthrough Constant Perturb Suppress

72 24 Concluding Remarks We designed and implemented ipshield which - proposes the use of inferences as the currency for privacy and utility specification. - advocates that the burden of configuring fine-grained privacy rules should be shifted from the user to the system. - provides insight into how and what data is being used by apps and better visibility into potential risks and consequences of sharing data. Going forward we want to... - develop the rule recommender to generate rules for obfuscating data. - augment ipshield with ability to perform static analysis of app code to better understand the risks presented by the apps. - allow crowd-sourcing for bootstrapping of rules. ipshield can be downloaded at

73 Thank You 25

74 26 Rules supported Rule ipshield Monitoring Privacy Abstraction Contexts SensorType Action Rule Recommender Fine-grained Rules Built-In External Enforcement Normal Constant Suppress Perturb Play-back Time Place App Day OfDay NameOfWeek Scalar Vector Distribution Name Distribution Param Walking Running... Sensor Sensor Sensor Source Source Type

75 26 Rules supported Rule ipshield Monitoring Privacy Abstraction Contexts SensorType Action Rule Recommender Fine-grained Rules Built-In External Enforcement Normal Constant Suppress Perturb Play-back Time Place App Day OfDay NameOfWeek Scalar Vector Distribution Name Distribution Param Walking Running... Sensor Sensor Sensor Source Source Type

76 26 Rules supported Rule ipshield Monitoring Privacy Abstraction Contexts SensorType Action Rule Recommender Fine-grained Rules Built-In External Enforcement Normal Constant Suppress Perturb Play-back Time Place App Day OfDay NameOfWeek Scalar Vector Distribution Name Distribution Param Walking Running... Sensor Sensor Sensor Source Source Type

77 26 Rules supported Rule ipshield Monitoring Privacy Abstraction Contexts SensorType Action Rule Recommender Fine-grained Rules Built-In External Enforcement Normal Constant Suppress Perturb Play-back Time Place App Day OfDay NameOfWeek Scalar Vector Distribution Name Distribution Param Walking Running... Sensor Sensor Sensor Source Source Type

ipshield Rules supported Monitoring Rule Contexts SensorType Privacy Abstraction Actual trace Spoofed trace Rule Recommender Action Fine-grained Rules

78 ipshield Rules supported Monitoring Rule Contexts SensorType Privacy Abstraction Actual trace Spoofed trace Rule Recommender Action Fine-grained Rules Built-In Bar External Normal Constant Suppress Perturb Scalar Time Place App Day NameOfWeek OfDay Walking Running Vector Play-back Classroom Distribution Distribution Name Param... Classroom Enforcement Sensor Friend s Sensor SensorSource Source Home Type Friend s Home Starbucks Bar Restaurant My Home My Home Rule: If ((TimeOfDay in [12am-11:59pm]) and (Place=Bar) and (AppName=Saga) then apply action = Constant and Value = Restaurant on SensorType = GPS; 26

79 27 Sensor usage for apps % of apps # sensors

80 28 Distribution of sensors by type Accelerometer GPS Microphone WiFi Soft Sensors Bluetooth Gyroscope Cellular Camera Others % of apps

u Emerging mobile applications that sense context are very important; e.g. for timely news and events, health tracking, social connections, etc.

November 11, 2013 Presented by: Merhawit Habte 1. Introduc,on u Emerging mobile applications that sense context are very important; e.g. for timely news and events, health tracking, social connections,