=
=
=
‹date/time›
=
=
=
‹=
footer›
=
=
=
‹#›
![](3D"master103_image001.gif")
Priv=
ate and
Trusted Interactions*
Bharat Bhargava, Leszek Lilie=
n, and
Dongyan Xu
Department of Computer Scienc=
es,
CERIAS† and=
CWSA‡
Purdue University
=
in collaboration with Ph.D. s=
tudents
and postdocs in the Raid Lab
Computer Sciences Building, R=
oom CS
145, phone: 765-494-6702
www.cs.purdue.edu/homes/bb=
3;
*
Supported in part by NSF gran=
ts
IIS-0209059, IIS-0242840, ANI-0219110, and Cisco URP grant. More grants are welcomed!
† Center for Education and Research in Information Assurance and Secur=
ity
(Executive Director: Eugene Spafford)
‡ Center for Wireless Systems and Applications (Director: Catherine P.
Rosenberg)
![](3D"master102_image002.gif")
![](3D"master102_image003.gif")
![](3D"master102_image004.gif")
3/23/04
2
Motiv=
ation
nSensitivity
of personal data &nbs=
p; =
[Ackerman et al. ‘99]
n82%
willing to reveal their favorite TV show
nOnly
1% willing to reveal their SSN
nBusiness losses due to privacy violations
nOnline
consumers worry about revealing personal data
nThis
fear held back $15 billion in online revenue in 2001
nFederal Privacy Acts to protect privacy
nE.g.,
Privacy Act of 1974 for federal agencies
nStill
many examples of privacy violations even by federal agencies
<=
/span>
nJetBlue
Airways revealed travellers’ data to federal gov’t
nE.g., Health Insurance Portability and Accountabi=
lity
Act of 1996 (HIPAA)
3/23/04
3
Priv=
acy and
Trust
nPrivacy Problem
nConsider computer-based interactions
<=
/span>
nFrom a simple transaction to a complex
collaboration
nInteractions involve dissemination
of private data
nIt is voluntary, “pseudo-voluntary,” =
or
required by law
nThreats of privacy violations result in lower tru=
st
nLower trust leads to isolation and lack of
collaboration
nTrust must be established
nData – provide quality an integrity
nEnd-to-end communication – sender authentic=
ation, message integrity
nNetwork routing algorithms – deal with mali=
cious
peers, intruders, securi=
ty
attacks
3/23/04
4
Fund=
amental
Contributions
nProvide measures of privacy and trust
=
nEmpower users (peers, nodes) to control privacy i=
n ad hoc environments
nPrivacy of user identification
=
nPrivacy of user movement
nProvide privacy in data dissemination
=
nCollaboration
nData warehousing
nLocation-based services
nTradeoff between privacy and trust
nMinimal
privacy disclosures
nDisclose private data absolutely necessary to gai=
n a
level of trust requ=
ired by
the partner system
n
3/23/04
5
Proposals and Publications
nSubmitted NSF proposals
n“Private and Trusted Interactions,” b=
y B.
Bhargava (PI) and L. Lilien (co-PI), March 2004.
n=
“Quality Healthcare Through Pervasive Data
Access,” by D. Xu (PI), B. Bhargava, C.-K.K. Chang, <=
span
style=3D'position:absolute;top:29.75%;left:12.54%;width:84.64%;height:3.2=
5%'>N. Li, C. Nita-Rotaru (co-PIs), March 2004.
<=
/span>
nSelected publications
n“On Se=
curity
Study of Two Distance Vector Routing Protocols for Mobile Ad Hoc Networks=
,” by W. Wang,
Y. Lu and B. Bhargava, Proc. of IEEE Intl. Conf. on Pervasive Computing a=
nd Communications (PerCom 2003), Dallas-Fort Worth, =
TX,
March 2003. http://w=
ww.cs.purdue.edu/homes/wangwc/PerCom03wangwc.pdf
n“Fraud
Formalization and Detection,” =
by B.
Bhargava, Y. Zhong and Y. Lu, Proc. of 5th Intl. Conf. on Data Warehousing and Knowledge Discovery (DaWaK
2003), Prague, Czech Republic, September
2003. http://www.cs.purdue.edu/ho=
mes/zhong/papers/fraud.pdf
n“Trust,
Privacy, and Security. Summary of a Workshop Breakout Session at the Nati=
onal
Science Foundation Infor=
mation
and Data Management (IDM) Workshop held in Seattle, Washington, September 14 - 16, 2003” by B. Bhargava, C. Farkas, L. Lilien and F. Maked=
on, CERIAS Tec=
h Report 2003-34, CERIAS, Purdue University, Novemb=
er
2003.
n http://www2.cs.washington.edu/nsf2003 or&=
#13;
n=
“e-Not=
ebook
Middleware for Accountability and Reputation Based Trust in Distributed D=
ata Sharing Communities,”
by P. Ruth, D. Xu, B. Bhargava and F. Regnier, Proc. of the Second International Conference on Trust Management (iTrust 2004)=
, Oxford,
UK, March 2004. http://www.cs.purdue.edu/ho=
mes/dxu/pubs/iTrust04.pdf
n“Position-Based Receiver-Contention Private
Communication in Wireless Ad Hoc Networks,” by X. Wu and B. Bhargava, submitted to the Tenth Annual=
Intl.
Conf. on Mobile Computing and Networking
(MobiCom’04), Philadelphia, PA, September - October 2004.
3/23/04
6
Outl=
ine
=
1.<=
/span>Assuring privacy in data
dissemination
=
2.Privacy-trust tradeoff
=
3.Privacy metrics
4.Example applications to networks =
and e-commerce
a.Privacy in location-based routing=
and services
in wireless networks
b.Privacy in e-supply chain managem=
ent systems
=
5.Prototype for experimental studie=
s
3/23/04
7
![](3D"slide0023_image005.gif")
1. P=
rivacy
in Data Dissemination
n“Guardian:”&=
#13;
n Entity entrusted by private data owners with
collection, storage, or transfer
of their data
<=
/span>
n=
owner can be a guardian for its own private data&=
#13;
n=
owner can be an institution or a system
nGuardians allowed or required by law to share pri=
vate
data
n=
With owner’s explicit consent
n=
Without the consent as required by law
nresearch, court order, etc.
&#=
8220;Data”
(Private
Data)
Guardian
2
Se=
cond
Level
![](3D"slide0023_image007.jpg")
![](3D"slide0023_image009.jpg")
![](3D"slide0023_image011.jpg")
![](3D"slide0023_image012.gif")
![](3D"slide0023_image013.gif")
![](3D"slide0023_image014.gif")
Guardian 1 &=
#13;
Original Guardian
![](3D"slide0023_image016.jpg")
![](3D"slide0023_image018.jpg")
![](3D"slide0023_image020.jpg")
![](3D"slide0023_image022.jpg")
Guardian 3
Guardian
5
Th=
ird-level
Guardian 6
Guardian 4
![](3D"slide0023_image023.gif")
![](3D"slide0023_image024.gif")
&#=
8220;Owner”
(Private
Data Owner)
![](3D"slide0023_image025.gif")
3/23/04
8
Prob=
lem of
Privacy Preservation
nGuardian
passes private data to another guardian in a data
dissemination chain
nChain within a graph (possibly cyclic)
nOwner privacy
preferences not transmitted due to neglect or failure=
nRisk
grows with chain length and milieu fallibility and
hostility
nIf
preferences lost, receiving guardian unable to honor them
3/23/04
9
Chal=
lenges
nEnsur=
ing
that owner’s metadata are never decoupled from his data
nMetadata
include owner’s privacy preferences
nEfficient
protection in a hostile milieu
nThreats
- examples
nUncontrolled
data dissemination
nIntentional or accidental data corruption, substi=
tution,
or disclosure
<=
/span>
nDetection
of data or metadata loss
nEfficient
data and metadata recovery
nRecovery by retransmission from the original guar=
dian is
most trustworthy=
3/23/04
10
Rela=
ted
Work
nSelf-descriptiveness
nMany papers use the idea of self-descriptiveness =
in diverse contexts (meta data model, KIF, context-a=
ware mobile infrastructure, flexible data types)
<=
/span>
nUse of self-descriptiveness for data privacy
=
nThe idea briefly mentioned in [Rezgui, Bouguettay=
a, and Eltoweissy, 2003]
nSecuring mobile self-descriptive objects
n=
Esp. securing them via apoptosis, that is clean s=
elf-destruction [Tschudin, 1999]
nSpecification of privacy preferences and policies=
nPlatform for Privacy Preferences [Cranor, 2003]&#=
13;
nAT&T Privacy Bird [AT&T, 2004]
n
n
n
3/23/04
11
Prop=
osed
Approach
A.D=
esign
self-descriptive private objects
B.Construct
a mechanism for apoptosis of private objects
apoptosis =3D clean
self-destruction
C.Develop
proximity-based evaporation of private objects
3/23/04
12
A.
Self-descriptive Private Objects
nComprehensive metadata include:
=
nowner’s
privacy preferences
=
nguardian priv=
acy
policies
=
nmetadata acce=
ss
conditions
=
nenforcement
specifications
=
ndata provenan=
ce
=
ncontext-depen=
dent
and
other components
=
=
=
=
n
=
=
=
How to read and write private data
For the original and/or subsequent data guardia=
ns
How to verify and modify metadata
How to enforce preferen=
ces and
policies
Who created, read, modi=
fied,
or destroyed any portion of data
Cust=
omer
trust levels for different contexts
3/23/04
13
Not=
ification
in Self-descriptive Objects
nSelf-descriptive
objects simplify notifying owners or requesting their
permissions
nContact
information available in the data provenance compon=
ent
nNotifications and
requests sent to owners immediately, periodically, or on
demand
nVia pagers, SMSs, email, mail, etc.
3/23/04
14
nTransmitting
complete objects between guardians is inefficient&#=
13;
nThey describe all foreseeable aspects of data <=
span
style=3D'position:absolute;top:44.5%;left:14.04%;width:79.96%;height:6.5%=
'>privacy
nFor any application and environment
nSolution:
prune transmitted metadata
nUse
application and environment semantics along the data dissemina=
tion
chain
Opti=
mization
of Object Transmission
3/23/04
15
B.
Apoptosis of Private Objects
nAssuring privacy in data dissemination
nIn benevolent settings:
n use atomic=
self-descriptive object with retransmission recovery
nIn malevolent settings:
n when attacked object threatened with disclosure, u=
se apoptosis (clean
self-destruction)
nImplementation
nDetectors, triggers, code
nFalse positive
nDealt with by retransmission recovery
=
nLimit repetitions to prevent denial-of-service
attacks
nFalse negatives
3/23/04
16
C. Proximity-based Evaporation
of Private Data=
of Private Data=
nPerfect data
dissemination not always desirable
nExample: Confidential business data shared within
n an office but not outsi=
de
nIdea: Private data evaporate in
proportion to
n their
“distance” from their owner
n“Closer” guardia=
ns
trusted more than “distant” ones
nIllegitimate disclosures more
probable at less trusted “distant” guardians
nDifferent distance metrics&#=
13;
nContext-dependent<=
/span>
3/23/04
17
nExamples of one-dimensional distance metrics
=
;
nDistance ~ business type
n
n
n
n
n
n
n
n
n
n
n
nDistance ~ distrust level: more trusted entities =
are
“closer”
nMulti-dimensional distance metrics
nSecurity/reliability as one of dimensions
Exam=
ples of Metrics
![](3D"slide0074_image026.gif")
Insurance Company
B
5
1
5
5
2
2
1
2
Bank I -Or=
iginal Gu=
ardian
Insurance Company
C
Insurance Company
A
Bank II
Bank III
Used Car Dealer
1
Used Car Dealer
2
Used Car Dealer
3
If a
bank is the original guardian, =
then:
--
any other bank is “closer”
than any insurance company
--
any insurance company is
“closer” than any used
car dealer
3/23/04
18
nDistorted data reveal less, protecting privacy=
3;
nExamples:
n accurate more and more distorted
Evaporation
Implemented as
Controlled Data Distortion
Controlled Data Distortion
250 N. Salisbury Street
West Lafayette, IN
250 N. Salisbury Street
West Lafayette, IN
[home address]
=
<=
/div>
765-123-4567
[home phone]
Salisbury Street
West Lafayette, IN
250 N. University Street
West Lafayette, IN
[office address]
765-987-6543
[office phone]
=
somewhere in
West Lafayette, IN
P.O. Box 1234
West Lafayette, IN
[P.O. box]
<=
/div>
765-987-4321
[office
fax]
![](3D"slide0099_image028.jpg")
![](3D"slide0099_image030.jpg")
![](3D"slide0099_image032.jpg")
![](3D"slide0099_image034.jpg")
![](3D"slide0099_image035.jpg")
![](3D"slide0099_image036.gif")
![](3D"slide0099_image037.gif")
![](3D"slide0099_image038.gif")
![](3D"slide0099_image039.gif")
![](3D"slide0099_image040.gif")
![](3D"slide0099_image041.gif")
![](3D"slide0099_image042.gif")
![](3D"slide0099_image043.gif")
![](3D"slide0099_image044.gif")
![](3D"slide0099_image045.gif")