Architecting Pervasive Computing Systems for Privacy: A Survey
---
paper_title: A note on the confinement problem

paper_content:

onfining a program during its execution so that it cannot transmit information to any other program except its caller. A set of examples attempts to stake out the boundaries of the problem. Necessary conditions for a solution are stated and informally justified.
---
paper_title: Perceptual user interfaces: things that see

paper_content:

The exponential decrease in the costs of computation and of communication is rapidly leading to convergence and ubiquity. At the same time, inexpensive computing power is enabling a quiet revolution in the machine perception of human action. In the near future, we expect machine perception to converge with ubiquitous computing and communication.
---
paper_title: Tarzan: a peer-to-peer anonymizing network layer

paper_content:

Tarzan is a peer-to-peer anonymous IP network overlay. Because it provides IP service, Tarzan is general-purpose and transparent to applications. Organized as a decentralized peer-to-peer overlay, Tarzan is fault-tolerant, highly scalable, and easy to manage.Tarzan achieves its anonymity with layered encryption and multi-hop routing, much like a Chaumian mix. A message initiator chooses a path of peers pseudo-randomly through a restricted topology in a way that adversaries cannot easily influence. Cover traffic prevents a global observer from using traffic analysis to identify an initiator. Protocols toward unbiased peer-selection offer new directions for distributing trust among untrusted entities.Tarzan provides anonymity to either clients or servers, without requiring that both participate. In both cases, Tarzan uses a network address translator (NAT) to bridge between Tarzan hosts and oblivious Internet hosts.Measurements show that Tarzan imposes minimal overhead over a corresponding non-anonymous overlay route.
---
paper_title: The Design of a Context-Aware Home Media Space for Balancing Privacy and Awareness

paper_content:

Traditional techniques for balancing privacy and awareness in video media spaces have been proven to be ineffective for compromising home situations involving a media space. As such, we present the rationale and prototype design of a context-aware home media space (HMS)—defined as an always-on video media space used within a home setting— that focuses on identifying plausible solutions for balancing privacy and awareness in compromising home situations. In the HMS design, users are provided with implicit and explicit control over their privacy, along with visual and audio feedback of the amount of privacy currently being maintained.
---
paper_title: Techniques for addressing fundamental privacy and disruption tradeoffs in awareness support systems

paper_content:

This paper describes a fundamental dual tradeoff that occurs in systems supporting awareness for distributed work groups, and presents several specific new techniques which illustrate good compromise points within this tradeoff space. This dual tradeoff is between privacy and awareness, and between awareness and disturbance. Simply stated, the more information about oneself that leaves your work area, the more potential for awareness of you exists for your colleagues. Unfortunately, this also represents the greatest potential for intrusion on your privacy. Similarly, the more information that is received about the activities of colleagues, the more potential awareness we have of them. However, at the same time, the more information we receive, the greater the chance that the information will become a disturbance to our normal work. This dual tradeoff seems to be a fundamental one. However, by carefully examining awareness problems in the light of this tradeoff it is possible to devise techniques which expose new points in the design space. These new points provide different types and quantities of information so that awareness can be achieved without invading the privacy of the sender, or creating a disturbance for the receiver. This paper presents four such techniques, each based on a careful selection of the information transmitted.
---
paper_title: An architecture for privacy-sensitive ubiquitous computing

paper_content:

Privacy is the most often-cited criticism of ubiquitous computing, and may be the greatest barrier to its long-term success. However, developers currently have little support in designing software architectures and in creating interactions that are effective in helping end-users manage their privacy. To address this problem, we present Confab, a toolkit for facilitating the development of privacy-sensitive ubiquitous computing applications. The requirements for Confab were gathered through an analysis of privacy needs for both end-users and application developers. Confab provides basic support for building ubiquitous computing applications, providing a framework as well as several customizable privacy mechanisms. Confab also comes with extensions for managing location privacy. Combined, these features allow application developers and end-users to support a spectrum of trust levels and privacy needs.
---
paper_title: Distributed Usage Control

paper_content:

Using a server-side architecture to connect specialized enforcement mechanisms with usage control requirements and policies.
---
paper_title: Crowds: Anonymity for Web Transactions

paper_content:

In this paper we introduce a system called Crowds for protecting users' anonymity on the world-wide-web. Crowds, named for the notion of “blending into a crowd,” operates by grouping users into a large and geographically diverse group (crowd) that collectively issues requests on behalf of its members. Web servers are unable to learn the true source of a request because it is equally likely to have originated from any member of the crowd, and even collaborating crowd members cannot distinguish the originator of a request from a member who is merely forwarding the request on behalf of another. We describe the design, implementation, security, performance, and scalability of our system. Our security analysis introduces degrees of anonymity as an important tool for describing and proving anonymity properties.
---
paper_title: Routing through the mist: privacy preserving communication in ubiquitous computing environments

paper_content:

Ubiquitous computing is poised to revolutionize the way we compute and interact with each other. However, unless privacy concerns are taken into account early in the design process, we will end up creating a very effective distributed surveillance system, which would be a dream come true for electronic stalkers and "big brothers". We present a protocol, which preserves the privacy of users and keeps their communication anonymous. In effect, we create a "mist" that conceals users from the system and other users. Yet, users will still be able to enjoy seamless interaction with services and other entities that wander within the ubiquitous computing environment.
---
paper_title: A Formal Model of Obfuscation and Negotiation for Location Privacy

paper_content:

Obfuscation concerns the practice of deliberately degrading the quality of information in some way, so as to protect the privacy of the individual to whom that information refers. In this paper, we argue that obfuscation is an important technique for protecting an individual's location privacy within a pervasive computing environment. The paper sets out a formal framework within which obfuscated location-based services are defined. This framework provides a computationally efficient mechanism for balancing an individual's need for high-quality information services against that individual's need for location privacy. Negotiation is used to ensure that a location-based service provider receives only the information it needs to know in order to provide a service of satisfactory quality. The results of this work have implications for numerous applications of mobile and location-aware systems, as they provide a new theoretical foundation for addressing the privacy concerns that are acknowledged to be retarding the widespread acceptance and use of location-based services.
---
paper_title: How to leak a secret

paper_content:

In this paper we formalize the notion of a ring signature, which makes it possible to specify a set of possible signers without revealing which member actually produced the signature. Unlike group signatures, ring signatures have no group managers, no setup procedures, no revocation procedures, and no coordination: any user can choose any set of possible signers that includes himself, and sign any message by using his secret key and the others' public keys, without getting their approval or assistance. Ring signatures provide an elegant way to leak authoritative secrets in an anonymous way, to sign casual email in a way which can only be verified by its intended recipient, and to solve other problems in multiparty computations. The main contribution of this paper is a new construction of such signatures which is unconditionally signer-ambiguous, provably secure in the random oracle model, and exceptionally efficient: adding each ring member increases the cost of signing or verifying by a single modular multiplication and a single symmetric encryption.
---
paper_title: Towards Meeting the Privacy Challenge : Adapting DRM *

paper_content:

Achieving the privacy needs for applications as expressed in law is complex. Currently there is no commonly accepted technical approach for meeting these privacy requirements. An often-fruitful way for uncovering solutions to challenges such as this is to examine how technologies used in quite different applications may be adapted for the purpose. In this paper, we examine the prospect of adapting systems designed for Digital Rights Management for the purpose of Privacy Rights Management for European Community. We begin by outlining the legal requirements for privacy under the European Union Data Directive. After an overview of digital rights management systems, we describe adaptations for transforming a DRM system into a privacy rights management system. We also detail the strengths and weaknesses of this approach.
---
paper_title: Privacy by Design - Principles of Privacy-Aware Ubiquitous Systems

paper_content:

This paper tries to serve as an introductory reading to privacy issues in the field of ubiquitous computing. It develops six principles for guiding system design, based on a set of fair information practices common in most privacy legislation in use today: notice, choice and consent, proximity and locality, anonymity and pseudonymity, security, and access and recourse. A brief look at the history of privacy protection, its legal status, and its expected utility is provided as a background.
---
paper_title: A Privacy Awareness System for Ubiquitous Computing Environments

paper_content:

Protecting personal privacy is going to be a prime concern for the deployment of ubiquitous computing systems in the real world. With daunting Orwellian visions looming, it is easy to conclude that tamper-proof technical protection mechanisms such as strong anonymization and encryption are the only solutions to such privacy threats. However, we argue that such perfect protection for personal information will hardly be achievable, and propose instead to build systems that help others respect our personal privacy, enable us to be aware of our own privacy, and to rely on social and legal norms to protect us from the few wrongdoers. We introduce a privacy awareness system targeted at ubiquitous computing environments that allows data collectors to both announce and implement data usage policies, as well as providing data subjects with technical means to keep track of their personal information as it is stored, used, and possibly removed from the system. Even though such a system cannot guarantee our privacy, we believe that it can create a sense of accountability in a world of invisible services that we will be comfortable living in and interacting with.
---
paper_title: Untraceable electronic mail, return addresses, and digital pseudonyms

paper_content:

A technique based on public key cryptography is presented that allows an electronic mail system to hide who a participant communicates with as well as the content of the communication - in spite of an unsecured underlying telecommunication system. The technique does not require a universally trusted authority. One correspondent can remain anonymous to a second, while allowing the second to respond via an untraceable return address. The technique can also be used to form rosters of untraceable digital pseudonyms from selected applications. Applicants retain the exclusive ability to form digital signatures corresponding to their pseudonyms. Elections in which any interested party can verify that the ballots have been properly counted are possible if anonymously mailed ballots are signed with pseudonyms from a roster of registered voters. Another use allows an individual to correspond with a record-keeping organization under a unique pseudonym, which appears in a roster of acceptable clients.
---
paper_title: Development and evaluation of emerging design patterns for ubiquitous computing

paper_content:

Design patterns are a format for capturing and sharing design knowledge. In this paper, we look at a new domain for design patterns, namely ubiquitous computing. The overall goal of this work is to aid practice by speeding up the diffusion of new interaction techniques and evaluation results from researchers, presenting the information in a form more usable to practicing designers. Towards this end, we have developed an initial and emerging pattern language for ubiquitous computing, consisting of 45 pre-patterns describing application genres, physical-virtual spaces, interaction and systems techniques for managing privacy, and techniques for fluid interactions. We evaluated the effectiveness of our pre-patterns with 16 pairs of designers in helping them design location-enhanced applications. We observed that our pre-patterns helped new and experienced designers unfamiliar with ubiquitous computing in generating and communicating ideas, and in avoiding design problems early in the design process.
---
paper_title: An anonymous communication technique using dummies for location-based services

paper_content:

Recently, highly accurate positioning devices enable us to provide various types of location-based services. On the other hand, because such position data include deeply personal information, the protection of location privacy is one of the most significant problems in location-based services. In this paper, we propose an anonymous communication technique to protect the location privacy of the users of location-based services. In our proposed technique, such users generate several false position data (dummies) to send to service providers with the true position data of users. Because service providers cannot distinguish the true position data, user location privacy is protected. We also describe a cost reduction technique for communication between a client and a server. Moreover, we conducted performance study experiments on our proposed technique using practical position data. As a result of the experiments, we observed that our proposed technique protects the location privacy of people and can sufficiently reduce communication costs so that our communication techniques can be applied in practical location-based services.
---
paper_title: Evaluating image filtering based techniques in media space applications

paper_content:

Media space applications that promote informal awareness in an organization confront an inevitable paradox: the shared video connections between offices and rooms that promote informal awareness also can rob individuals of privacy. An important open problem in this area is how to foster awareness of colleagues while minimizing the accompanying loss of privacy. One proposal put forward is to filter the communicated video streams rather than broadcasting clear video. Such a scheme may facilitate awareness while helping to alleviate some aspects of the privacy loss. In this article, we describe several image filtering techniques that provide awareness in informal group communication applications while blurring the details of an individual’s activities, thus potentially preserving more privacy. We describe studies to quantitatively and qualitatively assess the degrees of awareness and accuracy that these filtering techniques provide.
---
paper_title: Privacy and identity management for everyone

paper_content:

The shift from a paper-based to an electronic-based society has dramatically reduced the cost of collecting, storing and processing individuals' personal information. As a result, it is becoming more common for businesses to "profile" individuals in order to present more personalized offers as part of their business strategy. While such profiles can be helpful and improve efficiency, they can also govern opaque decisions about an individual's access to services such as credit or an employment position. In many cases, profiling of personal data is done without the consent of the target individual.In the past decade, the European Union and its member states have implemented a legal framework to provide guidance on processing of personal data with the specific aim to restore the citizens' control over their data. To complement the legal framework, the prime (Privacy and Identity Management for Europe) project [14] has implemented a technical framework for processing personal data. prime 's vision is to give individuals sovereignty over their personal data so that: Individuals can limit the information collected about them by using pseudo-identities, certifications and cryptography when performing online transactions, Individuals can negotiate legally-binding "privacy policies" with their service providers that govern how disclosed personal data can be used and which precautions must be taken to safeguard it, and Individuals and service providers can use automated mechanisms to manage their personal data and their obligations towards data which they have collected from other parties. To accomplish this, the prime project has designed and implemented a practical system-level solution which incorporates novel cryptographic protocols, sophisticated security protocols, and artificial intelligence algorithms. This paper describes the architecture of this system. Most key features of this architecture have been implemented in a proof-of-concept prototype.
---
paper_title: Tor: The Second-Generation Onion Router

paper_content:

We present Tor, a circuit-based low-latency anonymous communication service. This second-generation Onion Routing system addresses limitations in the original design by adding perfect forward secrecy, congestion control, directory servers, integrity checking, configurable exit policies, and a practical design for location-hidden services via rendezvous points. Tor works on the real-world Internet, requires no special privileges or kernel modifications, requires little synchronization or coordination between nodes, and provides a reasonable tradeoff between anonymity, usability, and efficiency. We briefly describe our experiences with an international network of more than 30 nodes. We close with a list of open problems in anonymous communication.
---
paper_title: Group Signatures

paper_content:

In this paper we present a new type of signature for a group of persons, called a group signature, which has the following properties: (i) only members of the group can sign messages; (ii) the receiver can verify that it is a valid group signature, but cannot discover which group member made it; (iii) if necessary, the signature can be "opened", so that the person who signed the message is revealed. ::: ::: The group signatures are a "generalization" of the credential/ membership authentication schemes, in which one person proves that he belongs to a certain group. ::: ::: We present four schemes that satisfy the properties above. Not all these schemes arc based on the same cryptographic assumption. In some of the schemes a trusted centre is only needed during the setup; and in other schemes, each pason can create the group he belongs to.
---
paper_title: Anonymous Usage of Location-Based Services Through Spatial and Temporal Cloaking

paper_content:

Advances in sensing and tracking technology enable location-based applications but they also create significant privacy risks. Anonymity can provide a high degree of privacy, save service users from dealing with service providers’ privacy policies, and reduce the service providers’ requirements for safeguarding private information. However, guaranteeing anonymous usage of location-based services requires that the precise location information transmitted by a user cannot be easily used to re-identify the subject. This paper presents a middleware architecture and algorithms that can be used by a centralized location broker service. The adaptive algorithms adjust the resolution of location information along spatial or temporal dimensions to meet specified anonymity constraints based on the entities who may be using location services within a given area. Using a model based on automotive traffic counts and cartographic material, we estimate the realistically expected spatial resolution for different anonymity constraints. The median resolution generated by our algorithms is 125 meters. Thus, anonymous location-based requests for urban areas would have the same accuracy currently needed for E-911 services; this would provide sufficient resolution for wayfinding, automated bus routing services and similar location-dependent services.
---
paper_title: The effects of filtered video on awareness and privacy

paper_content:

Video-based media spaces are designed to support casual interaction between intimate collaborators. Yet transmitting video is fraught with privacy concerns. Some researchers suggest that the video stream be filtered to mask out potentially sensitive information. While a variety of filtering techniques exist, they have not been evaluated for how well they safeguard privacy. In this paper, we analyze how a blur and a pixelize video filter might impact both awareness and privacy in a media space. Each filter is considered at nine different levels of fidelity, ranging from heavily applied filter levels that mask almost all information, to lightly applied filters that reveal almost everything. We examined how well observers of several filtered video scenes extract particular awareness cues: the number of actors; their posture (moving, standing, seated); their gender; the visible objects (basic to detailed); and how available people look (their busyness, seriousness and approachability). We also examined the privacy-preserving potential of each filter level in the context of common workplace activities. Our results suggest that the blur filter, and to a lesser extent the pixelize filter, have a level suitable for providing awareness information while safeguarding privacy.
---
paper_title: Efficient Context-aware Service Discovery in Multi-Protocol Pervasive Environments

paper_content:

Service discovery is a critical functionality of emerging pervasive computing environments. In such environments, service discovery mechanisms need to (i) overcome the heterogeneity of hardware devices, software platforms, and networking infrastructures; and (ii) provide users with an accurate selection of services that meet their current requirements. To address these issues, we have developed the Multi- Protocol Service Discovery and Access (MSDA) middleware platform^2, which provides context-aware service discovery and access in pervasive environments. This paper primarily focuses on the design and implementation of the context-awareness support of MSDA. Context-awareness not only provides a more accurate service selection, but also enables a more efficient dissemination of service requests across heterogeneous pervasive environments. We present the design and prototype implementation of MSDA, along with experimental results that demonstrate the advantages derived by introducing context awareness.
---

Title: Architecting Pervasive Computing Systems for Privacy: A Survey

Section 1: Introduction
Description 1: Provide background information on the concept of privacy and its importance in different cultures. Discuss security issues in pervasive computing systems and the need for privacy-aware system architectures.

Section 2: Privacy Protection Technologies
Description 2: Classify the various privacy technologies based on the types of attacks they counteract. Discuss strategies for protecting service access content, the existence of service access, information disclosure, and usage of obtained information.

Section 3: Attacker Privacy Invasion Strategy
Description 3: Describe the different strategies that various attackers—such as third parties, clients, and service providers—use to invade privacy.

Section 4: Towards a Pervasive Privacy Architecture
Description 4: Propose an architecture designed to control the disclosure of personal information in pervasive computing environments. Detail the mechanisms and architectural components that enforce access control, adjust data resolution, and protect communications.

Section 5: Conclusion
Description 5: Summarize the current progress in integrating privacy protection technologies within service-oriented architectures for pervasive computing and outline the future work to detail the architecture components and their interactions.