[PPT] - Personal Security and Privacy in Personal Security and Privacy in PowerPoint Presentation

SLIDE 1

Personal Security and Privacy in Personal Security and Privacy in Ubiquitous Computing

Marc Langheinrich Institute for Pervasive Computing Institute for Pervasive Computing ETH Zurich, Switzerland

SLIDE 2

Approaches to Security & Privacy in Ubicomp

Disappearing Computer Troubadour Project (10/02 05/03) Disappearing Computer Troubadour Project (10/02 - 05/03)

Promote Absence of Protection as User Empowerment

„ It's maybe about letting them find their own ways of cheating”

Make it Someone Elses Problem

„For [my colleague] it is more appropriate to think about [security

and privacy] issues. It’s not really the case in my case”

Insist that “Good Security” will Fix It

„All you need is really good firewalls“

C l d it i I tibl ith Ubi it C ti

Conclude it is Incompatible with Ubiquitous Computing

„I think you can't think of privacy... it's impossible, because if I do it,

I have troubles with finding [a] Ubicomp future”

Personal Security and Privacy in Ubiquitous Computing 2

I have troubles with finding [a] Ubicomp future

19.11.2007

SLIDE 3

Today‘s Topics

What is Privacy and Why Should We Want It? What is Privacy and Why Should We Want It? H

d F t S t E i t Ch ll

How do Future Smart Environments Challenge

Existing Solutions?

How Less Security Can (Sometimes) Increase

y Privacy

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 3

SLIDE 4

The Vision of Ubiquitous Computing

„The most profound technologies are those that disappear. They weave themselves into the fabric of everyday lif til th i di ti i h bl life until they are indistinguishable from it.“

Mark Weiser (1952 – 1999), XEROX PARC

Basic Motivation of Ubiquitous Computing

The computer as a tool for the everyday Things are aware of each other and the environment Integrating computers with intuitive user interfaces

Personal Security and Privacy in Ubiquitous Computing 4 19.11.2007

SLIDE 5

Energy-Efficient Heating

Sensors Inside and Outside

Takes Weather Forecast

into Account

„Conspires“ with Car of

Owner & E-Agenda to know Time of Arrival know Time of Arrival

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 5

SLIDE 6

Instead of „World inside the Computer“...

Not Not like this! World inside Computer would be Virtual Reality

Personal Security and Privacy in Ubiquitous Computing 6 19.11.2007

SLIDE 7

„Computer in the World“

!

Personal Security and Privacy in Ubiquitous Computing 7 19.11.2007

SLIDE 8

Is Technology a Good Predictor?

Past Predictions Past Predictions…

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 8

SLIDE 9

Societal Trends (Ubicomp Drivers)

Higher Efficiency

Lean production (Overproduction, Out-of-Stock) Targeted Sales (1-1 Marketing)

Targeted Sales (1 1 Marketing)

More Convenience

Finding your way (e g travel assistants)

Finding your way (e.g., travel assistants)

Lower TCO (“total cost of ownership”) w/ pay-per-use

Increased Safety

Homeland security (terrorism, drug trafficking, etc.) Road safety & health (e.g., black box for cars)

Personal Security and Privacy in Ubiquitous Computing 9

y & ( g , )

19.11.2007

SLIDE 10

So what does this mean for personal privacy? So what does this mean for personal privacy?

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 10

SLIDE 11

What is Privacy?

The right to be let alone “ „The right to be let alone.

Louis Brandeis, 1890 (Harvard Law Review)

h d i f l t h f l

Louis D Brandeis 1856 - 1941

„The desire of people to choose freely

under what circumstances and to what t t th ill th l

Louis D. Brandeis, 1856 1941

extent they will expose themselves, their attitude and their behavior to th “

thers.“

Alan Westin („Privacy And Freedom“, 1967)

Prof Emeritus Columbia University

Alan Westin

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 11

Prof. Emeritus, Columbia University

SLIDE 12

Why Privacy?

Reasons for Privacy Reasons for Privacy

Free from Nuisance

Intimacy

Intimacy Free to Decide for Oneself

B A th N

By Another Name...

Data Protection Informational Self-Determination

Privacy isn‘t just about keeping secrets –

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 12

y j p g data exchange and transparency are key issues!

SLIDE 13

“But I’ve Got Nothing to Hide!”

Do you?

Arson Near Youth House Niederwangen Arson Near Youth House Niederwangen

At scene of crime: Migros-tools

Court ordered disclosure of all 133

consumers who bought items on their supermarket loyalty card (8/2004) their supermarket loyalty card (8/2004)

(Arsonist not yet found)

“Give me six lines written by the most

Give me six lines written by the most honorable of men, and I will find an excuse in them to hang him”

d d l 8 6

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 13

excuse in them to hang him

Armand Jean du Plessis, 1585-1642 (a.k.a. Cardinal de Richelieu)

SLIDE 14

Ubicomp Privacy Implications

Data Collection Data Collection

Scale (everywhere, anytime)

Manner (inconspicuous invisible)

Manner (inconspicuous, invisible) Motivation (context!)

D t T

Data Types

Observational instead of factual data

Data Access

“The Internet of Things”

Personal Security and Privacy in Ubiquitous Computing 14 19.11.2007

SLIDE 15

How do we achieve privacy? How do we achieve privacy?

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 15

SLIDE 16

Privacy – Not Just a Recent Fad

Justices Of The Peace Act (England 1361)

Justices Of The Peace Act (England, 1361)

Sentences for Eavesdropping and Peeping Toms

The poorest man may in his cottage bid defiance to all

„The poorest man may in his cottage bid defiance to all

the force of the crown. It may be frail; its roof may shake; … – but the king of England cannot enter; all his forces … but the king of England cannot enter; all his forces dare not cross the threshold of the ruined tenement“

William Pitt the Elder (1708-1778)

( 7 77 )

First Data Protection Law in the World in Hesse

1970

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 16

SLIDE 17

The Fair Information Principles (FIP)

Drawn up by the OECD 1980

Drawn up by the OECD, 1980

“Organisation for economic cooperation and development” Voluntary guidelines for member states

y g

Goal: ease transborder flow of goods (and information!)

Five Principles (simplified)

1.

Openness

2.

Data access and control

4.

Collection Limitation

5.

Data subject’s consent

Core principles of most modern privacy laws

3.

Data security

Personal Security and Privacy in Ubiquitous Computing 17

Implication: Technical solutions must support FIP

19.11.2007

SLIDE 18

1. Challenge: Openness

No Hidden Data Collection!

Legal requirement in many countries

Established Means: Privacy Policies

Who, what, why, how long, etc. ...

How to Publish Policies in Smart Environments?

Is a poster enough? A paragraph of fine print?

Too Many Transactions? Too Many Transactions?

Countless announcements an annoyance

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 18

SLIDE 19

2. Challenge: Access & Control

Identifiable Data Must be Accessible Identifiable Data Must be Accessible

Users can review, change, sometimes delete

C ll

t M t b A t bl

Collectors Must be Accountable

Privacy-aware storage technology

When Does Sensor Data Become Identifiable?

Even anonymized data can identify people (AOL case)

Who to Ask? How to Verify? How to Display?

Who was reading me when? Is this really my trace?

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 19

g y y

SLIDE 20

3. Challenge: Data Security

Traditional Approach: Centralistic Authentication

Powerful centralized system with known user list Plan for worst case scenario (powerful attacker)

Numerous, Spontaneous Interactions

How do I know who I communicate with, who to trust?

h d “b ” k ?

How much extra time does “being secure” take?

Complex Real-World Situations

Access to my medical data in case of emergency?

Context-Dependent Security?

Based on battery power data type location situation

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 20

Based on battery power, data type, location, situation

SLIDE 21

4. Challenge: Data Minimization

Only collect as much information as needed Only collect as much information as needed

No in-advance data collection for future uses

B

t / d d t

Best: use anonymous/pseudonymous data

No consent, security, access needed

How much data is needed for becoming “smart”?

No useless data in smart environments (context!)

Sometimes one cannot hide!

Sensor data (biometrics) hard to anonymize

Slide 21

( ) y

19.11.2007 Personal Security and Privacy in Ubiquitous Computing

SLIDE 22

5. Challenge: Consent

Participation Requires Explicit Consent Participation Requires Explicit Consent

Usually a signature or pressing a button

True Consent Requires True Choice

More than „take it or leave it“, needs alternatives

How to Ask “On The Fly”?

How to Ask On The Fly ?

The mobile phone as a background agent (legal issues?)

Consenting to What? Consenting to What?

Do I understand the implications?

D I h ti ?

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 22

Do I have options?

SLIDE 23

Ubicomp Challenges to Security & Privacy

1

How to inform subjects about data

1.

How to inform subjects about data collections?

2

How to provide access to stored data?

2. How to provide access to stored data?
3. How to ensure confidentiality, integrity,

d h i i ( li i )? and authenticity (w/o alienating user)?

4. How to minimize data collection?
5. How to obtain consent from data subjects?

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 23

SLIDE 24

Public Concern over Unauthorized RFID Access

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 24

SLIDE 25

Unauthorized RFID Access – Implications

Passpor ssport:

Name: John Doe Nationality: USA Visa for: Isreal

Wi Wig

Modell #2342 Material: Polyester Visa for: Isreal

atories Juels, RSA Labora

Tiger T ger Tanga anga:

Manufacturer: Woolworth Washed: 736

rk (c) 2006 Ari J

Wallet llet

:Contents: 370 Euro

Vi Viagra:

Manufacturer: Pfitzer

RFID-Man” Artwo

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 25 :Contents: 370 Euro Disability Card: #2845 Extra Large Package

Original “R

SLIDE 26

Securing RFID Access

General Principle: Lock/Unlock ID With Password General Principle: Lock/Unlock ID With Password

Tag only replies if correct password/secret is sent

Requires RFID-Owner to Know Secret

d b f d h k ( h )

Password must be transferred at checkout (where to?)

Requires Owner to Know Which Secret to Use Requires Owner to Know Which Secret to Use

Chicken And Egg Problem: If you don‘t know what tag

it is how do you know what password to use? it is, how do you know what password to use?

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 26

SLIDE 27

Deactivation and Password Management… Does Your Solution Work Here?

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 27

SLIDE 28

Alternative: Shamir Tags

A E l f Z M t P i P t ti An Example for Zero-Managament Privacy Protection

Default: Tags Take Long Time To Read Out Default: Tags Take Long Time To Read Out

Complicates Tracking & Unauthorized Identification

Bitwise release short range (e g one random bit/sec)

Bitwise release, short range (e.g., one random bit/sec) Intermediate results meaningless, since encrypted

Decryption requires all bits being read

But: Known Tags Can be Directly Identified

Allows owner to use tags without apparent restrictions Initial partial release of bits enough for instant

id tifi ti f li it d t f k t identification from a limited set of known tags

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 28

SLIDE 29

Secret Shares (Shamir 1979)

Polynomial of degree n can be described using at least n+1 n+1 points P2 P1 P3

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 29

SLIDE 30

Secret Shares (Shamir 1979)

P2 P1 P3

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 30

SLIDE 31

96 bit EPC C d

011010111…1101 Secret s

96‐bit EPC‐Code 106‐bit Shamir Share

111000011…101101 101101101…110111 101010011…101101 Shares hi 111000011101010001010111010101101010100…1010101110101 Shamir Tag

318‐bit Shamir Tag

10‐bit x‐value 96‐bit y‐value

g P2 P1 P3

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 31

SLIDE 32

96 bit EPC C d

011010111…1101 Secret s

96‐bit EPC‐Code 106‐bit Shamir Share

111000011…101101 101101101…110111 101010011…101101 Shares hi 111000011101010001010111010101101010100…1010101110101 Shamir Tag

318‐bit Shamir Tag

10‐bit x‐value 96‐bit y‐value

g 111000011101010001010111010101101010100…1010101110101 Initial Reply

16‐bit Reply

Instant identification

f known items

Time

+1 bit

111000011101010001010111010101101010100…1010101110101

+1 bit

f known items
sure Over T

+1 bit

111000011101010001010111010101101010100…1010101110101

+1 bit

111000011101010001010111010101101010100…1010101110101

+1 bit

Bit Disclo 111000011101010001010111010101101010100…1010101110101

+1 bit +1 bit

111000011101010001010111010101101010100…1010101110101

Unknown tags will eventually be identified

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 32

SLIDE 33

Preventing Tracking

000101111010101111101011010100011011010 0110111101001

Tag 3

Readout 3

111000011101010001010111010101101010100…1010101110101

Tag 1

000101111010101111101011010100011011010…0110111101001

Original Readout Readout 3

Tag 2

111000011101010001010111010101101010100…1010101110101

Tag 1

Readout 1 Readout 2

010100111000110101010110010100001010101…1010100001100

Tag 2

Subsequent readouts receive only substring of bits

Insufficient data to track tag repeatedly E.g., tag population of 109 over 3 million tag have 5 bits in common

g g p p g

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 33

SLIDE 34

# of Overlapping Bits Between 2 Readouts

atories Juels, RSA Labora

E.g., a 0.12% chance that the same 5 bit positions are read from >=2 tags

rk (c) 2006 Ari J

E.g., a 0.12% chance that the same 5 bit positions are read from 2 tags

RFID-Man” Artwo

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 34

Original “R

t1 t2

SLIDE 35

More Privacy Through Less Security?

Shamir Tags Require No Consumer Effort Shamir Tags Require No Consumer Effort

Delay upon first use, but no passwords to manage!

Not useful for important“ items (passports e money)

Not useful for „important items (passports, e-money) Does not alleviate user concerns (tags remain active)

Building Block for Comprehensive Solution

Strong crypto for passports, drug-authenticity, … Clipping/killing for concerned consumers Unconcerned consumers get basic protection „for free“

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 35

SLIDE 36

Summing Up! Summing Up!

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 36

SLIDE 37

Take Home Message(s)

Privacy is more than just „good security“

Privacy is more than just „good security

It‘s about sharing and control

Smart environments pose new challenges

p g

Novel data types, increased # of incidents, implicit

interactions

i d i b bl b f l!

Security and privacy must be usable to be useful!

Almost never primary goals, get easily „in the way“

Goal: security/privacy mechanisms that „just work“

Shamir Tags: protection from unauthorized readouts Shamir Tags: protection from unauthorized readouts

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 37

SLIDE 38

SPMU’08: Security & Privacy I i M bil Ph U Issues in Mobile Phone Use

Secure payment/ticketing and authentication systems

Usability issues in mobile phone security/privacy Public perception legal and social issues

Public perception, legal, and social issues

Digital rights management on mobile phones Options for using mobile phones in law enforcement Options for using mobile phones in law enforcement Organized by:

Workshop call soon on: www.pervasive2008.org

Organized by:

Rene Mayrhofer (Lancaster University, UK) Marc Langheinrich (ETH Zurich, Switzerland)

g ( u , )

Alexander De Luca (LMU Munich, Germany)

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 38

SLIDE 39

Take Home Message(s) & Thank You!

Privacy is more than just „good security“

Privacy is more than just „good security

It‘s about sharing and control

Smart environments pose new challenges

p g

Novel data types, increased # of incidents, implicit

interactions

i d i b bl b f l!

Security and privacy must be usable to be useful!

Almost never primary goals, get easily „in the way“

Goal: security/privacy mechanisms that „just work“

E g Shamir Tags: protection from unauthorized readouts E.g., Shamir Tags: protection from unauthorized readouts

19.11.2007 Personal Security and Privacy in Ubiquitous Computing 39