A Service-Oriented Middleware for Privacy Protection in Pervasive Computing Roberto Speicys Cardoso
Total Page:16
File Type:pdf, Size:1020Kb
A Service-oriented Middleware for Privacy Protection in Pervasive Computing Roberto Speicys Cardoso To cite this version: Roberto Speicys Cardoso. A Service-oriented Middleware for Privacy Protection in Pervasive Com- puting. Networking and Internet Architecture [cs.NI]. Université Pierre et Marie Curie - Paris VI, 2009. English. tel-00406399 HAL Id: tel-00406399 https://tel.archives-ouvertes.fr/tel-00406399 Submitted on 22 Jul 2009 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. No Ordre : de la th`ese THESE` present´ ee´ DEVANT L’UNIVERSITE´ PARIS-VI pour obtenir le grade de: DOCTEUR DE L’UNIVERSITE´ PARIS-VI Mention: Informatique PAR Roberto SPEICYS CARDOSO Equipe´ d’accueil: INRIA, Equipe-Projet´ ARLES Ecole´ Doctorale: Informatique, Tel´ ecommunications´ et Electronique de Paris TITRE DE LA THESE:` Intergiciel oriente´ services pour la protection de la vie privee´ dans les systemes` d’informatique diffuse SOUTENUE LE 15 / 06 / 2009 devant la commission d’Examen COMPOSITION DU JURY Licia CAPRA - University College London, ENGLAND Rapporteur Yves DESWARTE - LAAS - CNRS, FRANCE Rapporteur Daniel AUGOT - INRIA, FRANCE Examinateur Fabio KON - Universidade de Sao˜ Paulo - IME, BRESIL´ Examinateur Jacques MALENFANT - Universite´ PARIS-VI, FRANCE Examinateur Valerie´ ISSARNY - INRIA, FRANCE Directrice de These` Every night a world created, complete with furniture – friends made and enemies estab- lished; a world complete with braggarts and with cowards, with quiet men, with humble men, with kindly men. Every night relationships that make a world, established; and every morning the world torn down like a circus. At first the families were timid in the building and tumbling worlds but gradually the technique of building worlds became their technique. Then leaders emerged, then laws were made, then codes came into being. And as the worlds moved westward they were more complete and better furnished, for their builders were more experienced in building them. The families learned what rights must be observed – the right of privacy in the tent; the right to keep the past black hidden in the heart; the right to talk and to listen; the right to refuse help or to accept, to offer help or to decline it; the right of son to court and daughter to be courted; the right of the hungry to be fed; the rights of the pregnant and the sick to transcend all other rights. And the families learned, although no one told them, what rights are monstrous and must be destroyed: the right to intrude upon privacy, the right to be noisy while the camp slept, the right of seduction or rape, the right of adultery and theft and murder. These rights were crushed, because the little worlds could not exist for even a night with such rights alive. – John Steinbeck, The Grapes of Wrath Abstract The widespread usage of computing devices is eroding the individual’s right to privacy. Pervasive computing environments, where users interact with a number of computing devices unconscious of their presence, harm user privacy by generating digital trails of every ordinary user activity. Privacy protection is thus a critical factor for the success of pervasive computing applications. Service oriented pervasive computing, where resources and applications are modeled as services, offers a compelling implementation of pervasive computing. In service oriented computing, applications can more easily handle the openness, heterogeneity and dynamics typical of pervasive computing environments. Realization of this view requires a service oriented middleware that provides the basic features for provision and consumption of pervasive services: namely, service access, service discovery and service composition. The service oriented middleware is particularly critical for privacy protection in service ori- ented pervasive computing since privacy vulnerabilities at the middleware layer affect any application using the middleware. In this thesis, we study how a service oriented middleware affects the privacy of users in pervasive computing environments. Our contribution is a privacy-enhanced middleware that increases privacy protection during service access, discovery and composition. The middleware provides a service access protocol that enables nodes to communicate privately without the problems of public key encryption. The protocol splits messages through mul- tiple paths that resist to attackers controlling a certain number of nodes or networks. It also provides a privacy-enhanced service discovery protocol that uses encoded service descriptions to protect personal information and that reduces the trust requirements of service directories. Since different service descriptions can generate the same encoded data, attackers are unable to identify the original service from the encoded description in service announcements and requests. Finally, the middleware provides a service com- position mechanism that allows users to compare the privacy impact of executing service compositions that are functionally equivalent but define different partitions of data among service providers, thus enabling selection of the composition that causes the smallest im- pact on user privacy. The middleware features are implemented and evaluated in terms of performance and effectiveness. Our middleware architecture facilitates the development of service oriented pervasive applications that respect the privacy of individuals. Since the middleware handles the 3 privacy issues introduced by the underlying software platform, applications can focus on application-specific mechanisms for privacy protection. Users that consume services on top of this middleware are also able to more effectively protect their privacy, since they can rely on middleware provided functionalities to better control personal information disclosure. Contents 1 Introduction 1 1.1 Privacy and Technology . 2 1.1.1 A Working Definition of Privacy . 3 1.1.2 The Need for Privacy . 6 1.1.3 Impact of Computers on Privacy . 10 1.1.4 The Role of Architectures . 12 1.2 Pervasive Computing and Privacy . 14 1.2.1 Middleware for Pervasive Computing . 18 1.2.2 Service-oriented Pervasive Computing . 19 1.2.3 Privacy Issues in Service-oriented Pervasive Computing . 21 1.2.4 Pervasive Network Specification . 23 1.3 Document Organization . 27 2 Privacy in Service-Oriented Pervasive Computing: State of the Art 31 2.1 A Categorization of Privacy Invasion Strategies . 33 2.1.1 Strategies to Invade Privacy in Service-oriented Architectures . 35 2.1.2 A Framework for the Classification of Privacy Research . 37 2.2 Privacy Research in Service Access . 37 2.2.1 Protect the Existence of an Access . 38 2.2.2 Protect the Content of an Access . 44 2.2.3 Limit Data Disclosed for an Access . 45 2.2.4 Control Usage of Data Disclosed for an Access . 48 2.3 Privacy Research in Service Discovery . 50 2.3.1 Protect the Existence of an Access . 51 2.3.2 Protect the Content of an Access . 52 2.3.3 Limit Data Disclosed for an Access . 53 i 2.3.4 Control Usage of Data Disclosed for an Access . 53 2.4 Privacy Research in Service Composition . 54 2.4.1 Protect the Existence of an Access . 55 2.4.2 Protect the Content of an Access . 55 2.4.3 Limit Data Disclosed for an Access . 55 2.4.4 Control Usage of Data Disclosed for an Access . 56 2.5 Concluding remarks . 57 3 Multiple Paths for Communication Privacy in Service Access 59 3.1 Challenges for Privacy Protection in Service Access . 60 3.2 Adversary Model for Privacy Protection in HMANETs . 62 3.3 Efficient Multi-path Routing for HMANETs . 65 3.4 Adversary Tolerable Route Selection . 68 3.5 Private Message Transmission . 69 3.6 Experimental Results . 75 4 Privacy-enhanced Service Discovery 81 4.1 Service Discovery Protocols . 82 4.1.1 Syntactic Service Discovery . 84 4.1.2 Semantic Service Discovery . 85 4.1.3 A Model for Service Discovery Protocols . 87 4.2 Service Discovery Impact on Privacy . 89 4.2.1 Attack model . 90 4.2.2 Naive Protocols for Privacy-enhanced Service Discovery . 91 4.3 EVEY: A Protocol for Privacy-Enhanced Service Discovery . 93 4.3.1 EVEY Light . 94 4.3.2 EVEY Full . 100 4.3.3 EVEY Assessment . 109 4.4 Distributed EVEY for Pervasive Networks . 122 4.4.1 EVEY Mechanisms for Privacy in Distributed Service Discovery . 124 4.4.2 Distributed EVEY Assessment . 128 5 Privacy-aware Service Composition 133 5.1 Composition Paradigms . 134 5.2 Privacy Risks in Service Composition . 137 5.3 Using Fuzzy Cognitive Maps to Model Privacy Impact . 139 ii 5.3.1 Fuzzy Cognitive Maps . 139 5.3.2 Fuzzy Cognitive Maps with Causality Feedback . 144 5.3.3 Motivating Fuzzy Cognitive Maps with Causality Feedback . 145 5.3.4 Other Extensions to Fuzzy Cognitive Maps . 147 5.4 Defining Disclosure Constraints for Personal Data . 148 5.4.1 Characterizing Data Privacy Impact . 148 5.4.2 Modeling Privacy Impact . 149 5.5 Comparing the Privacy Impact of Service Compositions . 150 5.5.1 A Model for Reasoning about Privacy of Service Compositions . 151 5.6 Illustration of the Model Usage . 154 5.6.1 Building the Model . 155 5.6.2 Using the Model . 156 5.7 Model Assessment . 159 6 A Privacy-enhanced Service-Oriented Middleware for Pervasive Com- puting 163 6.1 PLASTIC Overview . 164 6.2 The PREMISE Middleware Architecture . 166 6.3 The “Cupd” Application Scenario . 168 6.3.1 Service Composition . 170 6.3.2 Service Discovery . 173 6.3.3 Service Selection . 175 6.3.4 Service Access .