Towards a comprehensive analytical framework for smart toy privacy practices
Towards a comprehensive analytical framework for smart toy privacy practices
复制标题
建立智能玩具隐私实践的综合分析框架
DOI：
10.1145/3167996.3168002
复制
发表时间：
2018
影响因子：
10.6
通讯作者：
A. Youssef
中科院分区：
文献类型：
--
作者：
Moustafa Mahmoud;Md Zakir Hossen;Hesham Barakat;Mohammad Mannan;A. Youssef
智能玩具越来越受到儿童和家长的欢迎，主要是因为这种玩具的动态性质、优越的互动性和明显的教育价值。然而，由于这些玩具可能是联网的，并配备了各种可以记录儿童日常互动的传感器，它们可能会对儿童的安全和隐私构成严重威胁。事实上，近年来，有几个智能玩具被报道存在漏洞，一些关联公司也遭遇了大规模的数据泄露，暴露了通过这些玩具收集的信息。为了补充最近在分析和量化智能玩具安全性方面的努力，在这项工作中，我们提出了一个基于17个隐私敏感标准的全面分析框架，以系统地评估选定的智能玩具的隐私方面。我们的工作主要基于公开可用的(具有法律约束力的)隐私政策和使用条款文档，以及对配套的Android应用程序的静态分析，在大多数情况下，这些应用程序对于玩具的预期功能至关重要。我们使用我们的框架来评估一组具有代表性的11个智能玩具。我们的分析突显了有关数据存储做法和法律合规的信息不完整/缺乏，以及不必要地收集隐私敏感信息和使用过度特权应用程序的几个实例。拟议的框架是从隐私角度比较智能玩具的一步，这可能对玩具制造商、父母、监管机构和立法者有用。
Smart toys are becoming increasingly popular with children and parents alike, primarily due to the toys' dynamic nature, superior-interactivity, and apparent educational value. However, as these toys may be Internet-connected, and equipped with various sensors that can record children's everyday interactions, they can pose serious security and privacy threats to children. Indeed, in the recent years, several smart toys have been reported to be vulnerable, and some associated companies also have suffered large-scale data breaches, exposing information collected through these toys. To complement recent efforts in analyzing and quantifying security of smart toys, in this work, we propose a comprehensive analytical framework based on 17 privacy-sensitive criteria to systematically evaluate selected privacy aspects of smart toys. Our work is primarily based on publicly available (legally-binding) privacy policies and terms of use documentation, and a static analysis of companion Android apps, which are, in most cases, essential for intended functioning of the toys. We use our framework to evaluate a representative set of 11 smart toys. Our analysis highlights incomplete/lack of information about data storage practices and legal compliance, and several instances of unnecessary collection of privacy-sensitive information, and the use of over-privileged apps. The proposed framework is a step towards comparing smart toys from a privacy perspective, which can be useful to toy manufacturers, parents, regulatory bodies, and law-makers.