Towards Privacy Preserving Internet of Things

隐私是物联网（IoT）广泛采用的主要障碍之一。物联网的发展步伐可能会进一步加剧隐私问题，因为它融入了我们的日常互动，其嵌入式传感器的复杂性和准确性也在不断提高。然而，用户不舒服的最终来源是对直接从传感器传输到外部世界的个人数据缺乏控制。以高粒度收集的数据可以揭示与身体流动性、财务状况、健康问题和宗教偏好等相关的敏感信息。访问控制和隐私保护方法需要重新审视和仔细设计，以应对物联网中动态变化的环境，满足不同的用户需求，为数据提供商提供更大的灵活性，并为消费者提供更好的保护。当前的访问控制机制基于请求实体的身份提供访问，未能捕捉物联网的独特特征，其互联系统以及日益增长的用户需求。鉴于物联网数据的不可预测使用，访问控制架构必须允许灵活的访问策略定义，以支持不同的使用需求。在保持访问框架的通用性的同时引入这种灵活性仍然是一个重大挑战。此外，人们并不总是意识到在开放环境中收集数据可能会损害他们的隐私。向收集实体宣布个人隐私偏好并强制执行这种偏好的概念完全缺乏。本研究的目的是开发一个整体的隐私保护框架，将隐私从底层集成到物联网系统中。这将加速物联网的采用，降低用户更好地管理隐私的障碍，并展示整个异构物联网生态系统互操作性的最佳实践。该研究计划将从三个方向解决物联网隐私挑战。我们建议(1)开发强大的访问控制技术，以应对高度动态和开放的物联网环境，旨在严格控制对物联网设备的访问；(2)设计和开发用户可以信任的个人隐私代理模块，以监控数据收集，管理对其私人数据的访问，并在物联网支持的环境中持续执行其隐私偏好/策略；(3)设计一个强大的，动态和基于语义的上下文管理平台，支持访问控制和隐私代理中的实时决策制定。该研究计划将支持10名学生，他们将在使用尖端设备的领先研究实验室接受专业培训。结果有望提高加拿大人利用智能城市服务的能力，这些服务可以在不牺牲隐私的情况下，在从商业智能到健康信息等各个领域提供更好的生活质量。

Privacy presents one of the chief impediments to widespread adoption of the Internet of Things (IoT). The progressive pace of IoT evolution is likely to further aggravate privacy concerns, as it weaves itself into our everyday interactions, with ever increasing sophistication and accuracy in its embedded sensors. The ultimate source of user discomfort though is the lack of control over personal data that is directly streamed from sensors to the outside world. Data collected at high granularity could reveal sensitive information pertaining, for instance, to physical mobility, financial circumstances, health issues, and religious preferences. Access control and privacy preserving approaches need to be revisited and carefully redesigned to cope with dynamically changing contexts in IoT, satisfy varying user needs, provide more flexibility to data providers and better protection for consumers. Current access control mechanisms provide access based on the identity of the requesting entity, failing to capture the unique characteristics of IoT, its interconnected systems, and its growing user demands. Given the unpredictable usage of IoT data, access control architectures must allow for flexible access policy definitions to support diverse usage needs. Introducing such kinds of flexibility while maintaining the generality of the access framework remains a significant challenge. Additionally, people are not always aware of data collection in open environments that may compromise their privacy. The concept of announcing personal privacy preferences to collecting entities and enforcing such preferences is entirely lacking. The objective of this research is to develop a holistic privacy preserving framework that integrates privacy into IoT systems from the ground up. This will accelerate adoption of IoT, lowering the barriers for users to better manage their privacy, and demonstrating best practices for interoperability across the entire heterogeneous IoT ecosystem. This research program will address IoT privacy challenges from three directions. We propose to (1) develop robust access control techniques that cope with highly dynamic and open IoT environments, aiming to tightly control access to IoT devices, (2) Design and develop a personal privacy broker module that users can trust to monitor data collection, manage access to their private data, and continuously enforce their privacy preferences/policies in IoT-enabled environments, (3) Devise a robust, dynamic and semantic-based context management platform to support real-time decision making in both access control and privacy brokers. This research program will support 10 students who will receive specialized training in a leading research lab using cutting-edge facilities. The outcomes promise to improve Canadians' ability to utilize smart city services that can offer a better quality of life, in domains varying from business intelligence to health informatics, without sacrificing their privacy.