Cybersecurity & Trust in Internet of Things (IoT): Agency and negotiability over personal data in smart devices in the home

网络安全

• 批准号: 2443102
• 金额: --
• 依托单位: University of Nottingham
• 依托单位国家: 英国
• 项目类别: Studentship
• 财政年份: 2020
• 资助国家: 英国
• 起止时间: 2020 至 无数据
• 项目状态: 未结题
• 来源: https://gtr.ukri.org/projects?ref=studentship-2443102
• 关键词: Cybersecurity; Trust; Internet; Things; IoT

nternet of Things is making everything smart through a network of items with sensors connected to the Internet (Minn et al., 2015). Smart devices are those items that connect to other devices or networks using wireless connectivity such as Wi-Fi, 5G (IGI Global, 2021). Smartphones, smart locks and smartwatches are examples of smart devices. According to the UK Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), personal data is any information that relates to an identified or identifiable individual such as name, email, NI number, location data (ICO, n.d.). Both the DPA and GDPR mandate that the design process for new products and services consider data protection and privacy risks within it. We argue that the state-of-the-art for storing personal data in the home and setting user preferences in smart devices requires research. Our research will (i) provide design and governance guidelines in a non-legalistic language for the manufacturers and service providers of smart devices to consider in the design process for new products and services. (ii) Consequently through standardisation, they will yield competitive advantage, and reduce their compliance, and data processing burden. (iii) Further, our research will bridge the gap between the manufacturers, service providers, privacy professionals and regulators concerning the data protection and privacy risks leading to privacy issues in smart devices. Our eventual goal is to translate the design and governance guidelines to a policy.Why is it important? Smart device users lack understanding of data privacy (Marwick & Boyd, 2014) and control over how their personal data is shared and processed (Broenink et al., 2010). Our proposed research will (a) enable and empower the users of smart devices to make informed choices about how much and who they share their data with and therefore have control over their personal data. (b) So the users can enjoy the tailored services of smart devices, to improve convenience and not worry about their data privacy. We will do this through co-creation of design and governance guidelines. A technical standpoint of our starting position is to assume a solution that brings data processing and storage closer to where it is generated, akin to Databox (McAuley et al., 2016). The guidelines for the solution will cover the architecture, user interface and interactions, so users can model their privacy settings and preferences without difficulty. It will also cover cybersecurity areas such as user authentication and data security.ReferencesBroenink, G., Hoepman, J.-H., Hof, C. van 't, van Kranenburg, R., Smits, D., & Wisman, T. (2010). The Privacy Coach: Supporting customer privacy in the Internet of Things. 1-10. http://arxiv.org/abs/1001.4459ICO. (n.d.). Information Commissioner's Office. https://ico.org.uk/for-organisations/guide-to-data-protection/IGI Global (2021) What is Smart Device https://www.igi-global.com/dictionary/smart-device/47498Marwick, A. E., & Boyd, D. (2014). Networked privacy: How teenagers negotiate context in social media. New Media and Society. https://doi.org/10.1177/1461444814543995McAuley, D., Brown, T., Glover K., Amar, Y., Mortier, R., Li, Q., Lodge, T., Haddadi, H., Hiwal, Poonam, Price, D., Zhao, R. (2019). Privacy-Aware Data Analytics Platform. https://github.com/me-box/databox/Minn, H., Zeng, M., & Bhargava, V. (2015). Towards a definition of the {Internet of Things (IoT)}. IEEE Internet Initiative, 1-86.

物联网是通过具有连接到互联网的传感器的物品网络使一切变得智能（Minn等人，2015年）。智能设备是指使用Wi-Fi、5G等无线连接连接到其他设备或网络的设备（IGI Global，2021）。智能手机、智能锁和智能手表是智能设备的示例。根据英国《数据保护法》（DPA）和《通用数据保护条例》（GDPR），个人数据是指与已识别或可识别个人相关的任何信息，例如姓名、电子邮件、NI号码、位置数据（ICO，未注明）。DPA和GDPR都要求新产品和服务的设计过程考虑其中的数据保护和隐私风险。我们认为，在家中存储个人数据和在智能设备中设置用户偏好的最新技术需要研究。我们的研究将（i）以非法律语言为智能设备制造商和服务提供商提供设计和治理指南，供其在新产品和服务的设计过程中考虑。(ii)因此，通过标准化，他们将产生竞争优势，并减少他们的合规性和数据处理负担。(iii)此外，我们的研究将弥合制造商、服务提供商、隐私专业人员和监管机构之间关于智能设备中导致隐私问题的数据保护和隐私风险的差距。我们的最终目标是将设计和治理指导方针转化为策略。智能设备用户缺乏对数据隐私的理解（Marwick & Boyd，2014），也无法控制如何共享和处理他们的个人数据（Broenink等人，2010年）。我们建议的研究将（a）使智能设备的用户能够就他们与谁分享多少数据做出明智的选择，从而控制他们的个人数据。(b)因此，用户可以享受智能设备的定制服务，提高便利性，而不必担心他们的数据隐私。我们将通过共同创建设计和治理指南来实现这一目标。我们的出发点的技术观点是假设一种解决方案，该解决方案使数据处理和存储更接近其生成的地方，类似于数据盒（McAuley et al.，2016年）。该解决方案的指导方针将涵盖架构、用户界面和交互，因此用户可以毫无困难地对其隐私设置和偏好进行建模。它还将涵盖网络安全领域，如用户身份验证和数据安全。Hoepman，J. H、霍夫角货车t，货车Kranenburg，R.，Smits，D.，& Wisman，T.（2010年）。隐私教练：支持物联网中的客户隐私。1-10. http://arxiv.org/abs/1001.4459ICO.（未注明）。信息专员办公室。 https://ico.org.uk/for-organisations/guide-to-data-protection/IGI Global（2021）什么是智能设备https：//www.igi-global.com/dictionary/smart-device/47498Marwick，A. E、& Boyd，D.（2014年）。网络隐私：青少年如何在社交媒体中协商上下文。新媒体与社会https：//doi.org/10.1177/1461444814543995McAuley，D.，布朗，T.，格洛弗K.，Amar，Y.，莫蒂埃河，李，Q.，洛奇，T.，Haddadi，H.，Hiwal，Poonam，Price，D.，Zhao河，巴西-地（2019年）。隐私感知数据分析平台。https：//github.com/me-box/databox/Minn，H.，曾，M. & Bhargava，V.（2015）.关于物联网（IoT）的定义IEEE Internet Initiative，1-86。