ipShield: A Framework For Enforcing Context-Aware Privacy · Sensor subsystem in android and data...

Supriyo Chakraborty, Chenguang Shen, Kasturi Rangan Raghavan, Yasser Shoukry, Matt Millar, Mani Srivastava

ipShield: A Framework For EnforcingContext-Aware Privacy

From sensor data to inferences

Sensor Data

Apps Inferences

mHealth

Phone operation

Utility ProvidingFitness

Lifelogging

Sensor Data

Sensitive

LocationPassword

Media habitsPhysiological habits

Inferences

mHealth

Phone operation

Lifelogging

Location

Sensitive

Password

Utility Providing

mHealth

Phone operationLifelogging

Sensor Data

Apps Inferences

Fitness

Location

Sensitive

Password

Utility Providing

mHealth

Sensor Data

Apps Inferences

Fitness

Location

Sensitive

Password

Utility Providing

mHealth

Sensor Data

Apps Inferences

Fitness

Location

Sensitive

Password

Utility Providing

mHealth

Sensor Data

Apps Inferences

Fitness

Protecting inference privacy while providing utility

Sensor Data

Sensitive

LocationPassword

Inferences

mHealth

Phone operation

Lifelogging Whi

Sensor Data

Sensitive

LocationPassword

Inferences

mHealth

Phone operation

Lifelogging

Inference firewall

Sensor Data

Sensitive

LocationPassword

Inferences

mHealth

Phone operation

Lifelogging

Inference firewall ✖

Prior notions of privacy in databases

Sensor DataCapture

Data Processing

Population Scale Database

D := {P = personal identifiers, (name, ID)Q = quasi identifiers, (age, zip code)V = measurement values (sensor data)}

Sensor DataCapture

Data Processing

InformationRecipient

1. K-anonymity2. L-Diversity3. t-closeness

Privacy

M=<P’,Q’,V

inference = identity

D := {P = personal identifiers, (name, ID)Q = quasi identifiers, (age, zip code)V = measurement values (sensor data)}

Sensor DataCapture

Data Processing

1. K-anonymity2. L-Diversity3. t-closeness

Differential Privacy

Privacy

M=<P’,Q’,V

Privacy

M=R(<P,Q,V>)+noise

inference = identity

inference = membershipD := {P = personal identifiers, (name, ID)Q = quasi identifiers, (age, zip code)V = measurement values (sensor data)}

Sensor DataCapture

Data Processing

Aggregate Queries

Sharing anIndividual’s data

M:=<P, Q, V’>

Sensor DataCapture

Data Processing

Aggregate Queries

Sharing anIndividual’s data

Privacy of Data(secrecy)

Privacy of Identity(anonymity)

Traditional

Privacy of Behavior

M:=<P, Q, V’>

Controls provided by current systems are insufficientAndroid Manifest

Binary Policies

Controls provided by current systems are insufficientpDroid

Static Policies

Controls provided by current systems are insufficientProtectMyPrivacy

Share Random Data

Design requirements of ipShield

8Protected

Sensor Monitoring

Protected

Combination of benign sensors can be used for privacy attack

Sensor Monitoring

Network

Accelerometer

Microphone

Sensor Monitoring

Network

Accelerometer

Microphone

Location

Transportation Mode

Password/PIN

Stress

Media Watching

Privacy Abstraction

Sensor Monitoring

Privacy Abstraction

TranslationAlgorithms

Privacy Rules on Sensors

Whitelist/Blacklist

User Privacy Preferences

Rule Enforcement

Sensor Monitoring

Privacy Abstraction

Whitelist/Blacklist

Rule Enforcement

Rule Recommender

Sensor Monitoring

Privacy Abstraction

Whitelist/Blacklist

Rule Enforcement

Rule Recommender

Manual Override (Rules)

Sensor Monitoring

Privacy Abstraction

Whitelist/Blacklist

Rule Enforcement

Rule Recommender

Manual Override (Rules)

Rule Enforcement

Rule Recommender

Whitelist/Blacklist

Privacy rules on sensors

Recommender objective

Generate a plan for context-aware obfuscation of sensor data

depending on the prioritized whitelist and blacklist

such that accuracy of whitelist is maximized and accuracy of blacklist is minimized.

Divide-and-conquer strategy

Recommend a plan containing allow/deny rules for sensors

Divide-and-conquer strategy

Recommend a plan containing allow/deny rules for sensors

Support manual override/configuration of fine-grained context-aware rules

Elements of the problem: accuracy

Activity Location OnScreen Taps

GPS+Acc+Gyro 95% 97% 80%

GPS+WiFi 83.1% 97% 0%

GPS+GSM 81.7% 98.2% 0%

GSM+WiFi 72.9% 94.03% 0%

GPS+WiFi 83.1% 97% 0%

GPS+GSM 81.7% 98.2% 0%

GSM+WiFi 72.9% 94.03% 0%

SensorCombination

GPS+WiFi 83.1% 97% 0%

GPS+GSM 81.7% 98.2% 0%

GSM+WiFi 72.9% 94.03% 0%

SensorCombination

InferenceType

GPS+WiFi 83.1% 97% 0%

GPS+GSM 81.7% 98.2% 0%

GSM+WiFi 72.9% 94.03% 0%

SensorCombination

InferenceType

Accuracy of Prediction

Elements of the problem: priority

Priority = (pactivity

location

↓ ↓ ↓{10, 4, 10}priority = Prio

Elements of the problem: priority

Priority = (pactivity

location

↓ ↓ ↓{10, 4, 10}priority = Prio

priorityWhitelisted inferences

↑ ⇒ allow whitelisted inferences

Blacklisted inferencespriority↑ ⇒ block blacklisted inferences

�22N

l2WA(�, l)2pl �

l2BA(�, l)2pl

l2B,pl

A( , l) = 0

� = Sensor combination

W = whitelist, B = blacklist, pl = priority, and

Rule recommender in ipShield

�22N

l2WA(�, l)2pl �

l2BA(�, l)2pl

l2B,pl

A( , l) = 0

⇓� = Sensor combination

Over all sensor combinations

�22N

l2WA(�, l)2pl �

l2BA(�, l)2pl

l2B,pl

A( , l) = 0

Over all sensor combinations maximize accuracy of prioritized whitelist and

�22N

l2WA(�, l)2pl �

l2BA(�, l)2pl

l2B,pl

A( , l) = 0

Over all sensor combinations maximize accuracy of prioritized whitelist and minimize accuracy of prioritized blacklist

�22N

l2WA(�, l)2pl �

l2BA(�, l)2pl

l2B,pl

A( , l) = 0

Over all sensor combinations maximize accuracy of prioritized whitelist and minimize accuracy of prioritized blacklist

such that highest priority blacklists are always blocked.

Rule recommender at work

GPS+WiFi 83.1% 97% 0%

GPS+GSM 81.7% 98.2% 0%

GSM+WiFi 72.9% 94.03% 0%

GPS+WiFi 83.1% 97% 0%

GPS+GSM 81.7% 98.2% 0%

GSM+WiFi 72.9% 94.03% 0%

Priority1{10, 4, 10}

731.45

GPS+WiFi 83.1% 97% 0%

GPS+GSM 81.7% 98.2% 0%

GSM+WiFi 72.9% 94.03% 0%

Priority1{10, 4, 10}

731.45

GPS+WiFi 83.1% 97% 0%

GPS+GSM 81.7% 98.2% 0%

GSM+WiFi 72.9% 94.03% 0%

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

Prototype implementation on Android

Sensor subsystem in android and data interception

Third Party Apps

System Server

LocationManagerService

Sensor Manager

Location Manager

Sensor DataSensor Data

Hardware

Android Native/Linux Kernel

System Processes User Processes

Android Framework

SensorService

Third Party Apps

System Server

Sensor Manager

Location Manager

Hardware

Android Framework

SensorService

Third Party Apps

System Server

Sensor Manager

Location Manager

Hardware

Android Framework

SensorService

Third Party Apps

System Server

Sensor Manager

Location Manager

Hardware

Android Framework

SensorService

Third Party Apps

System Server

Sensor Manager

Location Manager

Hardware

Android Framework

}App and Managers run as part of the same process

SensorService

Third Party Apps

System Server

Sensor Manager

Location Manager

Hardware

Android Framework

}App and Managers run as part of the same process

} Services run in separatesystem owned processes

SensorService

Implementing ipShield

Sensor Manager

Location Manager

Hardware

Native Runtime

Trusted App part of ipShield

Trusted App (User Process)

Whitelist and Blacklist of inference ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

SensorService

System Server

Sensor Manager

Location Manager

Hardware

Native Runtime

Semantic Firewall Configurator

FirewallConfigManager

FirewallConfigService

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

SensorService

System Server

Sensor Manager

Location Manager

Hardware

Native Runtime

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

SensorService

System Server

InferenceDatabase

Sensor Manager

Location Manager

Hardware

Native Runtime

Whitelist and Blacklist of inference

RuleRecommender

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

SensorService

System Server

InferenceDatabase

Sensor Manager

Location Manager

Hardware

Native Runtime

ContextEngine Rule

Recommender

DirectConfigurator

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

SensorService

System Server

InferenceDatabase

Sensor Manager

Location Manager

Hardware

Native Runtime

ContextEngine Rule

Recommender

DirectConfigurator

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

SensorService

System ServerObfuscatorObfuscator

InferenceDatabase

User interaction with ipShield

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained RulesSuppress

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Feasibility of running ipShield on mobile platforms

1 50 100 150 200

# rules

time to load rules into memorytime for the rules to take effect

1 50 100 150 200

# rules

0.1SENSOR_DELAY_NORMAL, SENSOR_DELAY_UI

1 50 100 150 200

# rules

SENSOR_DELAY_GAME

1 50 100 150 200

# rules

SENSOR_DELAY_GAME

SENSOR_DELAY_FASTEST

26.325

26.575

AOSP Passthrough Constant Perturb Suppress

26.325

26.575

AOSP Passthrough Constant Perturb Suppress

Concluding Remarks

•We designed and implemented ipShield which- proposes the use of inferences as the currency for privacy and utility

specification.- advocates that the burden of configuring fine-grained privacy rules

should be shifted from the user to the system.- provides insight into how and what data is being used by apps and better

visibility into potential risks and consequences of sharing data.

• Going forward we want to...- develop the rule recommender to generate rules for obfuscating data.- augment ipShield with ability to perform static analysis of app code to

better understand the risks presented by the apps.- allow crowd-sourcing for bootstrapping of rules.

ipShield can be downloaded at http://tinyurl.com/ipshieldgit

Thank You

Rules supported

Contexts Action

Built-In External

TimeOfDay

SensorType

AppName

DayOfWeek

Walking Running ...

Suppress Perturb Play-back

DistributionName

DistributionParam

SensorSource

Constant

Scalar Vector

SensorType

Normal

SensorSource

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

Rules supported

Contexts Action

Built-In External

TimeOfDay

SensorType

AppName

DayOfWeek

Walking Running ...

DistributionName

DistributionParam

SensorSource

Constant

Scalar Vector

SensorType

Normal

SensorSource

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

Rules supported

Contexts Action

Built-In External

TimeOfDay

SensorType

AppName

DayOfWeek

Walking Running ...

DistributionName

DistributionParam

SensorSource

Constant

Scalar Vector

SensorType

Normal

SensorSource

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

Rules supported

Contexts Action

Built-In External

TimeOfDay

SensorType

AppName

DayOfWeek

Walking Running ...

DistributionName

DistributionParam

SensorSource

Constant

Scalar Vector

SensorType

Normal

SensorSource

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

Rules supported

Rule: If ((TimeOfDay in [12am-11:59pm]) and (Place=Bar) and (AppName=Saga) then apply action = Constant and Value = Restaurant on SensorType = GPS;

Contexts Action

Built-In External

TimeOfDay

SensorType

AppName

DayOfWeek

Walking Running ...

DistributionName

DistributionParam

SensorSource

Constant

Scalar Vector

SensorType

Normal

SensorSource

Classroom

My Home

Friend’sHome

StarbucksBar

Restaurant

Actual traceSpoofed trace

My Home

Friend’sHome

Classroom

ipShield

Monitoring

Privacy Abstraction

Rule Recommender

Fine-grained Rules

Enforcement

Sensor usage for apps

1 2 3 4 5 6

# sensors

Distribution of sensors by type

Accelerometer

Microphone

Soft Sensors

Bluetooth

Gyroscope

Cellular

Camera

Others

0 5 10 15 20

% of apps

ipShield: A Framework For Enforcing Context-Aware Privacy · Sensor subsystem in android and data...

Documents

Enforcing Enterprise-out Security for Cloud Servers - WIPdocs.media.bitpipe.com/io_10x/io_106859/item_589088/Enforcing... · Enforcing Enterprise-out Security for Cloud Servers

Interception of Communications Act

3. Interception by Police - Queensland Police Service - Chapte… · 3. interception by police 3.1 introduction 2 3.2 static interception 2 3.2.1 establishing a static interception

Dynamic Trust Enforcing Pricing Scheme for Sensors-as-a ... · competitive sensor-owners, i.e., oligopolistic market, and heterogeneous sensor nodes in service-oriented sensor-cloud

Https interception proxies

Chapter 4.4 Surveillance: Lawful Interception & Other Surveillance … · 2017-06-14 · Lawful interception refers to the interception ofor access to, a person’s communications

Contrasting roles of interception and transpiration in the ... · transpiration, vegetation interception, ﬂoor interception, soil moisture, and open water, although the names and

4. INTERCEPTION

Design and Implementation of a Sensor Network System for ... · Design and Implementation of a Sensor Network System for Vehicle Tracking and Autonomous Interception ... The early

Elint Interception & Analysis

3. Interception by Police

GEOG415 Lecture 3A: Interception

Interception Management System

Gsm Interception

Policy Enforcing

SSL Interception Proxies and Transitive Trust · SSL Interception Proxies and Transitive Trust ... –lient relies on Proxy’s validation of server-side certificate . ... SSL Interception

Enforcing punishment

Enforcing Modularity

Defending, challenging and interception

Lawful Interception - Swincaia.swin.edu.au/talks/CAIA-TALK-060209A.pdfHistory of Lawful Interception - Research ... History of Lawful Interception - Research (3) Chan and Camp,