Privacy by Design in an IoT Environment. Alfred Kobsa

Transcription

1 Privacy by Design in an IoT Environment Alfred Kobsa D o n a l d B re n S c h o o l o f I n fo r m at i o n a n d C o m p u te r S c i e n c e s U n i ve rs i t y o f C a l i fo r n i a, I r v i n e

2 DARPA Brandeis Initiative Burgeoning landscape of existing privacy technologies Anonymization, randomization, differential privacy Defining & enforcing privacy policies, learning user preferences secure computation, homomorphic encryption, searchable encryption Limited real-world deployment More than 10 years since initial papers on differential privacy [Dwork 06], but limited real-world usage. 15+ years of research on secure computation, but existing solutions support limited computation or are inefficient. The goal of Brandeis is to substantially increase the usage of privacy technologies by trialing them in real-world testbeds.

3 Experimental Testbeds for Privacy Technologies 3 Brandeis Testbeds Mobile Computing, Information Sharing Workflow, Internet of Things IoT Testbed Participants UCI, Honeywell: Testbed for IoT-based Privacy-Preserving PERvasive Spaces TIPPERS UMass, Duke, Colgate: Differential privacy CMU: Personal Policy Agent Stealth Technologies: Secure Computation Galois Technologies, Cybernetica: Metrics & Evaluation

4 Internet of Things Systems that empower everyday physical devices to connect to the internet and exchange data Short & long term adaptations Decisions, Control actions

5 IoT-related Privacy Risks: Some Studies Study of electric usage in dorms was able to identify student activities [Mulligan et. al] Motion tracking through pressure changes in HVAC system [Patel et. al] Automatic detection of daily activities in assisted living homes from observing electrical events [Berenguer et. al] Study of pressure sensing to infer real-world water usage events at home [Froehlich et. al] Using compact fluorescent lights for sensing human proximity [Gupta et. al] User behavior from cell phone tracking [Eagle and Pentland]

6 TIPPERS Instrumented Building: Bren Hall 6 story building 90,000 sq. ft classrooms 125 faculty offices 90 research labs Lecture halls Administrative offices Diverse set of sensors installed

7 TIPPERS Sensors Platform Building Infrastructure Mobile Phone (participants ) Raspberry Pi (5) PC (5 100+) Sensors Temperature (216 data points) HVAC sensors (116 data points) Wi-Fi Access Points (64 data points) Surveillance Cameras (40 covering all public areas) Bluetooth low energy Beacons (~100) WeMo Power Outlet / Energy Meters ( ) GPS Accelerometer Light Gyroscope Motion Wi-Fi Probe Request Sniffer Temperature Gas Light Humidity Activity Monitor (CPU usage, memory usage, CPU idle time etc.)

8 TIPPERS Application : Presence Concierge helps visitors and residents in Donald Bren Hall to find useful info about the building and its people (e.g. restrooms, meeting rooms, location of individuals in the contact list, events in calendar) Noodle a smart meeting organization tool which enables the organizer and participants to track each other in real-time (e.g., Claire has arrived at the meeting, Sarah is 5 minutes away ). Also, enables organizer to record meetings if meeting in appropriately instrumented space. Policies & user preferences play a vital role in these applications

9 TIPPERS Application : Energy REPORT is a smart dashboard for users and building administrators to monitor energy usage and presence information in the building spaces. DIME is a smart environment being installed in Room 2065 in Bren Hall. It uses multiple sensors with the goal of monitoring the energy consumption and human presence. Color coded map of energy usage versus occupancy. Will allow ability to zoom into regions and explore usage over time. Enables users to see what devices are on and their energy consumption. Will allow users to turn on/off devices to see impact on energy consumption

10 Integration of Privacy Technologies into TIPPERS Applications Concierge Observer Analyst CMU IoT Resource Registry Discover resource Personal Privacy Assistant User settings User settings Observed Subject API Encrypted query UCI Honeywell Observer API TIPPERS Sensor Management -Data collection & management Data abstraction, enrichment, -Policy Enforcement, logging. Device/Sensor API DBMS API Policy G=(E,p) Error toler. System P: Differentially- Private Data Management Privacy Utility Analysis PULSAR : secure Data Management DP team Answer Error bound(s) Budget rem. E Utility gain Galois Stealth Observed subject Sensors/Devices Logs Privacy Analyzer Cybernetica

11 Observed Subjects Tippers: Integration of secure computing Achieved through data management interface TIPPERS can store part/whole of its data on the untrusted cloud using the Presence Apps Concierge, Noodle,... Observed Subjects API secure data management technology of Stealth. Energy Apps(DIME, Report) Observer API Request / Query Manager Users/A pps/poli cies Registra tion Devices Registr ation Data Enrich ment Data Collecti on Privacy Prefere nces Privacy Settings Infrastructure State Manager Device/Sensor API Other Querie s Log Man ager Log Man ager DBMS API Semantic level Data Semantic Observation s Registry High-level Log Geograp hic data Register ed/activ e devices Raw Data Lowlevel Log Sensor/device level Data TIPPERS routes data and queries to the Cloud-based DBMS Results passed by DBMS to TIPPERS Secure Data Manage ment on the Cloud

12 Observed Subjects Tippers: Integration of differential privacy Achieved through data management interface. TIPPERS can store part of its data in a differentially private database system Presence Apps Concierge, Noodle,... Observed Subjects API technology being developed by Massachusetts team Energy Apps(DIME, Report) Observer API Request / Query Manager Users/A pps/poli cies Registra tion Devices Registr ation Data Enrich ment Data Collecti on Privacy Prefere nces Privacy Settings Infrastructure State Manager Device/Sensor API Other Querie s Log Man ager Log Man ager DBMS API Semantic level Data Semantic Observation s Registry High-level Log Geograp hic data Register ed/activ e devices Raw Data Lowlevel Log Sensor/device level Data TIPPERS routes data and queries to the DP DBMS Results passed by DBMS to TIPPERS Differentially-Private Data Management Technology

13 Finer Control to Intercept Communication between Components (privacy technology interventions) Mechanisms to intercept communication between between H/W & S/W components seamlessly support privacy technologies Examples Location data intercepted and passed through DP mechanism before sharing with occupancy analysis application Enforcement of target s privacy policy prior to sharing. Virtual Sensors targets Observer/ code Application Differential privacy technology

14 Integration of Differential Privacy Mechanisms TIPPERS Semantic Observations Occupancy Heat-maps based on WiFi AP dataset (with/without DP)

15 Policies in TIPPERS Coverage: capture, storage, processing, sharing Apply to Infrastructure devices (e.g., cameras installed in Bren Hall) User devices (e.g., cell phones brought into Bren Hall) Policies can defined by: Infrastructure managers E.g., video surveillance is on after hours and during weekends only camera apps of phones will be deactivated in parts of the building Individual Users E.g., do not track my location 16

16 Usage scenario

17 Privacy is a process, not a PET (Morton & Sasse 2012)

18 Top-down and bottom-up research approach to Privacy by Design Fostering the right mindset of those responsible for developing and running data processing systems Koops & Leenes Foundational Principles of Privacy by Design (A. Cavoukian) Privacy Design Strategies (Hoepman 2014) Data Protection Goals (Pfitzmann, Hansen, Rost) Privacy Design Patterns / Concrete Guidelines Multiple Integrated Privacy Technologies