Towards a new data privacy-based approach for IoT
Year: 2019
Type: preprint
Abstract: The Internet of Things (IoT) connects and shares data collected from smart devices in several domains, such as smart home, smart grid, and healthcare. According to Cisco, the number of connected devices is expected to reach 500 Billion by 2030. Five hundred zettabytes of data will be produced by tremendous machines and devices. Usually, these collected data are very sensitive and include metadata, such as location, time, and context. Their analysis allows the collector to deduce personal habits, behaviors and preferences of individuals. Besides, these collected data require the collaboration of several parties to be analyzed. Thus, due to the high level of IoT data sensitivity and lack of trust on the involved parties in the IoT environment, the collected data by different IoT devices should not be shared with each other, without enforcing data owner privacy. In fact, IoT data privacy has become a severe challenge nowadays, especially with the increasing legislation pressure. Our research focused on three complementary issues, mainly (i) the definition of a semantic layer designing the privacy requirements in the IoT domain, (ii) the IoT device monitoring and the enforcement of a privacy policy that matches both the data owner’s privacy preferences and the data consumer’s terms of service, and (iii) the establishment of an end-to-end privacy-preserving solution for IoT data in a decentralized architecture while eliminating the need to trust any involved IoT parties.To address these issues, our work contributes to three axes. First, we proposed a new European Legal compliant ontology for supporting preserving IoT PrivacY, called LIoPY that describes the IoT environment and the privacy requirements defined by privacy legislation and standards. Then, we defined a reasoning process whose goal is generating a privacy policy by matching between the data owner’s privacy preferences and the data consumer’s terms of service. This privacy policy specifies how the data will be handled once shared with a specific data consumer. In order to ensure this privacy policy enforcement, we introduced an IoT data privacy-preserving framework, called PrivBlockchain, in the second research axis. PrivBlockchain is an end-to-end privacy-preserving framework that involves several parties in the IoT environment for preserving IoT data privacy during the phases of collection, transmission, storage, and processing. The proposed framework relied on, on the one hand, the blockchain technology, thus supporting a decentralized architecture while eliminating the need to trust any involved IoT parties and, on the other hand, the smart contracts, thus supporting a machine-readable and self-enforcing privacy policy whose goal is to preserve the privacy during the wholedata lifecycle, covering the collection, transmission, storage and processing phases. Finally, in the third axis, we designed and implemented the proposal in order to prove its feasibility and analyze its performances.
Source: HAL
Author: Faiza Loukil
Institution: Université Jean Moulin Lyon III
Language: French
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W3010337058