Personal Privacy in Ubiquitous Computing Tools and System Support. Marc Langheinrich

Transcription

1 Personal Privacy in Ubiquitous Computing Tools and System Support Marc Langheinrich

2 Ubiquitous Computing and Privacy Disappearing Computer Troubadour Project (10/02-05/03) Other People s Problem For [my colleague] it is more appropriate to think about privacy issues. It s not really the case in my case Privacy is Primarily a Security Problem All you need is really good firewalls It is All About Self-Regulation It's maybe about letting them find their own ways of cheating Incompatible with Ubiquitous Computing I think you can't think of privacy... it's impossible, because if I do it, I have troubles with finding [a] Ubicomp future November 3, 2005 Personal Privacy in Ubiquitous Computing 2

3 Ubiquitous Excuses? Computing and Privacy Disappearing Computer Troubadour Project (10/02-05/03) Other People s Problem For [my colleague] it is more appropriate to think about privacy issues. It s not really the case in my case Privacy is Primarily a Security Problem All you need is really good firewalls It is All About Self-Regulation It's maybe about letting them find their own ways of cheating Incompatible with Ubiquitous Computing I think you can't think of privacy... it's impossible, because if I do it, I have troubles with finding [a] Ubicomp future November 3, 2005 Personal Privacy in Ubiquitous Computing 3

4 The Vision of Ubiquitous Computing The most profound technologies are those that disappear. They weave themselves into the fabric of everyday life until they are indistinguishable from it. Mark Weiser ( ), XEROX PARC Basic Motivation of Ubiquitous Computing The computer as a tool for the everyday Things are aware of each other and the environment Integrating computers with intuitive user interfaces November 3, 2005 Personal Privacy in Ubiquitous Computing 4

5 Smart Toaster Gets weather forecast from the Internet Can remind you of important dates (from your electronic agenda) Quelle: November 3, 2005 Personal Privacy in Ubiquitous Computing 5

6 Instead of World inside the Computer... Not like this! World inside Computer would be Virtual Reality November 3, 2005 Personal Privacy in Ubiquitous Computing 6

7 Computer in the World! November 3, 2005 Personal Privacy in Ubiquitous Computing 7

8 Ubicomp Drivers (Technologies) Miniaturization Integration into everyday things New Materials Novel input/output capabilities Wireless Communication Simplifies communication Facilitates cooperation and coordination Sensors Smartness through context-awareness November 3, 2005 Personal Privacy in Ubiquitous Computing 8

9 Ubicomp Drivers (Society Trends) Higher Efficiency Lean production (Overproduction, Out-of-Stock) Targeted Sales (1-1 Marketing) More Convenience Finding your way (e.g., travel assistants) Lower TCO ( total cost of ownership ) w/ pay-per-use Increased Safety Homeland security (terrorism, drug trafficking, etc.) Petty crimes & negligence (e.g., traffic accidents, theft) November 3, 2005 Personal Privacy in Ubiquitous Computing 9

10 Example: Health Industry as Driving Factor for Ubiquitous Computing Higher Efficiency Localization system for medical personnel facilitates highly dynamic scheduling More Convenience Senior citizens can live independently with the help of a Smart Environment Increased Safety Electronically tagged blood packs and smart emergency room lower chances of mistakes November 3, 2005 Personal Privacy in Ubiquitous Computing 10

11 Today s Topics Analysis What is Privacy? How does Ubiquitous Computing affect it? Privacy Infrastructure (PawS) Privacy Beacons Privacy Proxies Privacy-Aware Database Real-World Example Privacy and RFID November 3, 2005 Personal Privacy in Ubiquitous Computing 11

12 Ubicomp Privacy Implications Data Collection Scale (everywhere, anytime) Manner (inconspicuous, invisible) Motivation (context!) Data Types Observational instead of factual data Data Access The Internet of Things November 3, 2005 Personal Privacy in Ubiquitous Computing 12

13 Ubicomp Privacy Implications Privacy is is not just other people s problem Privacy is is a core issue in in Ubicomp environments Data Collection Scale (everywhere, anytime) Manner (inconspicuous, invisible) Motivation (context!) Data Types Observational instead of factual data Data Access The Internet of Things November 3, 2005 Personal Privacy in Ubiquitous Computing 13

14 Why Privacy? Reasons for Privacy Free from Nuisance Louis D. Brandeis, The right to be let alone (1890) November 3, 2005 Personal Privacy in Ubiquitous Computing 14

15 Why Privacy? Reasons for Privacy Free from Nuisance Intimacy Erving M. Goffman, The Presentation of Self in Everyday Life (1959) November 3, 2005 Personal Privacy in Ubiquitous Computing 15

16 Why Privacy? Reasons for Privacy Free from Nuisance Intimacy Free to Decide for Oneself Beate Rössler Protecting the decisional autonomy in one s life (2001) November 3, 2005 Personal Privacy in Ubiquitous Computing 16

17 Why Privacy? Reasons for Privacy Free from Nuisance Intimacy Free to Decide for Oneself By Another Name... Data Protection Informational Self-Determination November 3, 2005 Personal Privacy in Ubiquitous Computing 17

18 Why Privacy? Privacy isn t just about keeping secrets data exchange and transparency are key issues! Reasons for Privacy Free from Nuisance Intimacy Free to Decide for Oneself By Another Name... Data Protection Informational Self-Determination November 3, 2005 Personal Privacy in Ubiquitous Computing 18

19 Solution Space Technology Social Norms & Habits Laws & Regulations November 3, 2005 Personal Privacy in Ubiquitous Computing 19

20 Fair Information Principles (FIP) Drawn up by the OECD, 1980 Organisation for economic cooperation and development Voluntary guidelines for member states Goal: ease transborder flow of goods (and information) Five Principles (simplified) 1. Openness 2. Data access and control 4. Collection Limitation 5. Data subject s consent 3. Data security Core principles of most modern privacy laws Implication: Technical solutions must support FIP November 3, 2005 Personal Privacy in Ubiquitous Computing 20

21 Fair Information Principles (FIP) Privacy is isnot just about self-regulation legal and social frameworks exist! Drawn up by the OECD, 1980 Organisation for economic cooperation and development Voluntary guidelines for member states Goal: ease transborder flow of goods (and information) Five Principles (simplified) 1. Openness 2. Data access and control 3. Data security 4. Collection Limitation 5. Data subject s consent Core principles of most modern privacy laws Implication: Technical solutions must support FIP November 3, 2005 Personal Privacy in Ubiquitous Computing 21

22 Technical Solution: P3P Platform for Privacy Preferences Project (W3C) Machine-readable data collection practices (Policy) Who collects and/or processes the data? What information is collected? For what purpose is this data collected? Basis-Dataschema Example: user.home.postal.street Web-Protocol For exchanging policies between server und browser Lorrie Cranor, Marc Langheinrich, Massimo Marchiori, Joseph Reagle: The Platform for Privacy Preferences 1.0 (P3P1.0) Specification. W3C Recommendation, April 16, November 3, 2005 Personal Privacy in Ubiquitous Computing 22

23 Technical Solution: P3P <POLICY xmlns=" entity= TheCoolCatalog, 123 Main Street, Seattle, WA 98103, USA"> <DISPUTES-GROUP> Platform <DISPUTES service=" for Privacy Preferences Project (W3C) resolution-type="independent" description="privacyseal, a third-party seal provider" image=" </DISPUTES-GROUP> Machine-readable data collection practices (Policy) <DISCLOSURE discuri=" access="none"/> <STATEMENT> <CONSEQUENCE-GROUP> <CONSEQUENCE>a Who collects site with clothes and/or you would processes appreciate</consequence> the data? </CONSEQUENCE-GROUP> <RECIPIENT><ours/></RECIPIENT> <RETENTION><indefinitely/></RETENTION> <PURPOSE><custom/><develop/></PURPOSE> <DATA-GROUP> What information is collected? <DATA For name="dynamic.cookies" what purpose category="state"/> is this data collected? <DATA name="user.gender"/> Basis-Dataschema <DATA name="dynamic.miscdata" category="preference"/> <DATA name="user.home." optional="yes"/> </DATA-GROUP> </STATEMENT> <STATEMENT> Example: user.home.postal.street <RECIPIENT><ours/></RECIPIENT> <PURPOSE><admin/><develop/></PURPOSE> <RETENTION><indefinitely/></RETENTION> Web-Protocol <DATA-GROUP> <DATA name="dynamic.clickstream.server"/> <DATA For name="dynamic.http.useragent"/> exchanging policies between server und browser </DATA-GROUP> </STATEMENT> </POLICY> Lorrie Cranor, Marc Langheinrich, Massimo Marchiori, Joseph Reagle: The Platform for Privacy Preferences 1.0 (P3P1.0) Specification. W3C Recommendation, April 16, November 3, 2005 Personal Privacy in Ubiquitous Computing 23

24 PawS A Privacy Awareness System Privacy Proxies Privacy Policy Accept / Decline Privacy Beacons Privacy DB November 3, 2005 Personal Privacy in Ubiquitous Computing 24

25 1. Privacy Beacons Announce (Unobtrusive) Data Collections Protocol Beacons integrated into communications protocol Stand-alone Beacons for video, audio, sensory data Detected by mobile Privacy Assistant (e.g., wristwatch) Describes Current/Potential Data Collection Format: machine-readable privacy policy ( P3P++ ) Extending it for Ubicomp-specific elements (e.g., sensor data) PA (Privacy Assistant) P3P policy Privacy Beacon November 3, 2005 Personal Privacy in Ubiquitous Computing 25

26 1. Privacy Beacons Announce (Unobtrusive) Data Collections Protocol Beacons integrated into communications protocol Stand-alone Beacons for video, audio, sensory data Detected by mobile Privacy Assistant (e.g., wristwatch) Describes Current/Potential Data Collection Format: machine-readable privacy policy ( P3P++ ) Privacy-Assistant Prototype Privacy-Beacon Prototype (IRREAL) Extending it for Ubicomp-specific elements (e.g., sensor data) PA (Privacy Assistant) P3P policy Privacy Beacon November 3, 2005 Personal Privacy in Ubiquitous Computing 26

27 2. Privacy Proxies Service Proxy Solicitates Consent (if Needed) User proxy compares user preferences with privacy policy of service provider Central Access Point for Data Management Supports updating and deleting data and contracts User Privacy Proxy Service Privacy Proxy Accept / Decline Privacy Policy Database Internet November 3, 2005 Personal Privacy in Ubiquitous Computing 27

28 2. Privacy Proxies Example of a user-initiated deletion request Service Proxy Solicitates Consent (if Needed) <DELETE> <DELETE> <DATA-GROUP> <DATA-GROUP> <DATA <DATA ref="#user.home-info.online. "/> ref="#user.home-info.online. "/> <DATA <DATA ref="#user.home-info.telecom.mobile"/> ref="#user.home-info.telecom.mobile"/>... User proxy compares user preferences with privacy policy of service provider... </DATA-GROUP> </DATA-GROUP> Central Access Point for Data Management </DELETE> </DELETE> Supports updating and deleting data and contracts User Privacy Proxy Service Privacy Proxy Accept / Decline Privacy Policy Database Internet November 3, 2005 Personal Privacy in Ubiquitous Computing 28

29 2. Privacy Proxies <QUERY> <QUERY> <DATA-GROUP> Example of a user-initiated deletion request Example of a service-initiated data update request <DATA-GROUP> Service <DATA <DATA Proxy ref="#user.location.submitted.symbolic.city"/> ref="#user.location.submitted.symbolic.city"/> Solicitates Consent (if Needed) <DELETE> <DELETE> <DATA <DATA-GROUP> <DATA ref="#user.location.submitted.symbolic.street"/> ref="#user.location.submitted.symbolic.street"/> <DATA-GROUP> </DATA-GROUP> <DATA User </DATA-GROUP> proxy compares user preferences with privacy <DATA ref="#user.home-info.online. "/> <INFO ref="#user.home-info.online. "/> <DATA <INFO discuri=" <DATA policy ref="#user.home-info.telecom.mobile"/> discuri=" We ref="#user.home-info.telecom.mobile"/> of service provider... We need need your your current current location location in order order to to provide provide you you with with... </DATA-GROUP> </DATA-GROUP> updated updated information information as as part part of of your your WHERE_AM_I(tm)-subscription. WHERE_AM_I(tm)-subscription. Central </INFO> Access Point for Data Management </DELETE> </INFO> </DELETE> </QUERY> </QUERY> Supports updating and deleting data and contracts User Privacy Proxy Service Privacy Proxy Accept / Decline Privacy Policy Database Internet November 3, 2005 Personal Privacy in Ubiquitous Computing 29

30 3. Privacy-Aware Database All Data is Stored Together With Privacy (P3P) Policy Data and policy (Metadata) form logical unit Each Data Access Needs Usage Policy Database compares allowed/announced and proposed usage Data with non-matching allowed usage is held back Each data access (who, why) is recorded (auditing) <last name> <first name> <birthdate> <address> Personal Data Usage Policy Individual Privacy Policy November 3, 2005 Personal Privacy in Ubiquitous Computing 30

31 3. Privacy-Aware Database All Data is Stored Together With Privacy (P3P) Policy Data and policy (Metadata) form logical unit Each Data Access Needs Usage Policy Database compares allowed/announced and proposed usage Data with non-matching allowed usage is held back Each data access (who, why) is recorded (auditing) Example Example result result of of a a policy-based policy-based query query <last name> <first name> <birthdate> <address> Personal Data Usage Policy Individual Privacy Policy November 3, 2005 Personal Privacy in Ubiquitous Computing 31

32 PawS Example Camera Proxy Printer Proxy User Privacy Proxy Privacy Policy Accept / Decline Privacy Beacon Devices PA (Privacy Assistant) November 3, 2005 Personal Privacy in Ubiquitous Computing 32

33 PawS Implementation Privacy Database Oracle 8i, Java interface (no direct table access) P3P policies cached for speed Privacy Proxies Web service (Apache Tomcat) SOAP, SSH, DSig Extended P3P Privacy Beacons IR Beacon (IRREAL) Palm Tungsten C (WLAN) Privacy Policy Accept / Decline November 3, 2005 Personal Privacy in Ubiquitous Computing 33

34 PawS Implementation Privacy is iscompatible with Ubiquitous Computing technical solutions can support FIP FIP in in Ubicomp Privacy Database Oracle 8i, Java interface (no direct table access) P3P policies cached for speed Privacy Proxies Web service (Apache Tomcat) SOAP, SSH, DSig Extended P3P Privacy Beacons IR Beacon (IRREAL) Palm Tungsten C (WLAN) Privacy Policy Accept / Decline November 3, 2005 Personal Privacy in Ubiquitous Computing 34

35 Today s Topics Analysis What is Privacy? How does Ubiquitous Computing affect it? Privacy Infrastructure (PawS) Privacy Beacons Privacy Proxies Privacy-Aware Database Real-World Example Privacy and RFID November 3, 2005 Personal Privacy in Ubiquitous Computing 35

36 Today s RFID Systems Original RFID-Man Artwork (c) 2006 Ari Juels, RSA Laboratories Privacy Policy The information we learn from customers helps us personalize and continually improve your shopping experience. ID ID ID All tags respond, please! ID ID ID ID Slide Courtesy of Roland Schneider November 3, 2005 ID Personal Privacy in Ubiquitous Computing 36 DB ID ID ID ID ID

37 RFID-PawS Goal: Fair Information Principles for RFID PawS and RFID Privacy Beacon: RFID-Reader Privacy Assistant: Watchdog-Tag Privacy Proxies & Privacy Database Requirements RFID-Standard compatibility Low bandwith Christian Floerkemeier, Roland Schneider, Marc Langheinrich: Scanning with a Purpose Supporting the Fair Information Principles in RFID protocols. UCS 2004, Tokyo, Japan, November November 3, 2005 Personal Privacy in Ubiquitous Computing 37

38 Example: Openness in RFID-PawS Protocol extension Init round all SUID flag Round size CRC-5 1 bit 6 bits 1 bit 3 bits 5 bits Init_Round Command in ISO Part 6 Defines start of reading cycle (Aloha-based anti-collision) Defines Anti-collision protocol parameters November 3, 2005 Personal Privacy in Ubiquitous Computing 38

39 Example: Openness in RFID-PawS Protocol extension Init round all SUID flag Round size CRC-5 RPID Purpose Collection type CRC-16 1 bit 6 bits 1 bit 3 bits 5 bits 96 bits 16 bits 2 bits 16 bits Init_Round Command in ISO Part 6 Defines start of reading cycle (Aloha-based anti-collision) Defines Anti-collision protocol parameters New: 130 Bits Privacy-Header Extension November 3, 2005 Personal Privacy in Ubiquitous Computing 39

40 Openness using the ReaderPolicyID Protocol extension Init round all SUID flag Round size CRC-5 RPID Purpose Collection type CRC-16 1 bit 6 bits 1 bit 3 bits 5 bits 96 bits 16 bits 2 bits 16 bits Header Data Collector Policy Reader 8 bits 28 bit 24 bits 36 bits 5F.4A886EC.8EC947.24A68E4F6 Each Read Request can be Associated with Data Collector Data collector, reader, and privacy policy identifiable Format follows EPC standard (facilitates implementation) November 3, 2005 Personal Privacy in Ubiquitous Computing 40

41 RFID-PawS and Fair Information Principles Principle Openness Data Access & Control Data Security Collection Limitation User Consent Supported by ReaderPolicyID PawDB (PawDB) Tag Selection Mask, Purpose Declaration Watchdog-Tag November 3, 2005 Personal Privacy in Ubiquitous Computing 41

42 Today s RFID Systems (with RFID-PawS) Original RFID-Man Artwork (c) 2006 Ari Juels, RSA Laboratories Privacy Policy The information we learn from customers helps us personalize and continually improve your shopping experience. ID Example Store, Smart Shelf 4: LocalAll Identification; tags Inventory; respond, All please! ID ID ID ID Openness ID Data DataAccess & Control Control ID PawDB ID ID ID ID ID Slide Courtesy of Roland Schneider November 3, 2005 ID Personal Privacy in Ubiquitous Computing 42

43 Tomorrow s RFID-Systems? Example Store, Smart Shelf 4: Local Identification; Inventory; All PawDB Original RFID-Man Artwork (c) 2006 Ari Juels, RSA Laboratories??? Collection Limitation ID ID ID User User Consent Openness Data DataAccess & Control Control ID ID ID Slide Courtesy of Roland Schneider November 3, 2005 Personal Privacy in Ubiquitous Computing 43

44 PawS: Limits and Open Issues Privacy Beacon Signal (Stand-alone Mode) Needs localization model when using wireless announcements (WLAN, Bluetooth, Zigbee) User Interface for Privacy Assistant Needs user study to assess practical usefulness Limited to Institutional Data Collections Not very useful for peer privacy (e.g., friend finder applications) Sensor Data? Anonymity? Location Privacy? November 3, 2005 Personal Privacy in Ubiquitous Computing 44

45 Summary Other Privacy People s Core Problems in Ubicomp Environments For Ubicomp [my colleague] significantly it is affects more appropriate privacy to think about privacy issues. Requires It s solutions not really on the multiple case in levels my case (collection & processing) Privacy is Primarily not Just About a Security Security Problem All Data you exchange need iswith reallyothers good firewalls just as important It Legal is All and About Social Self-Regulation Frameworks exist Basis: It's maybe Fair Information about letting Principles them find their own ways of cheating Incompatible Technical Privacy withinfrastructure Ubiquitous Computing Possible I Privacy think Beacons, you can't Privacy think of Assistants, privacy... it's Privacy impossible, Proxies, because Privacy if DBI do it, I have troubles with finding [a] Ubicomp future Embedded in legal and social mechanisms November 3, 2005 Personal Privacy in Ubiquitous Computing 45

46 Much Related Work Privacy Infrastructures Myles et al. 03, Aura 03, Confab Toolkit 04 User Interfaces CSCW (Bellotti/Sellen 93, Neustaedter/Greenberg 03) Peer Privacy (Aware Home Project, Confab Toolkit) Identity Management Borking s Identity Protector 96, Lederer s Faces 02 Privacy Databases k-anonymity 02, Hippocratic Databases 02, Enterprise P3P 02 Web Privacy, RFID Privacy, Location Privacy November 3, 2005 Personal Privacy in Ubiquitous Computing 46