Semantic Access Control for Privacy Management of Personal Sensing in Smart Cities
Total Page：16
File Type：pdf, Size：1020Kb
© 2020 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. arXiv:2101.03209v1 [cs.CR] 8 Jan 2021 1 Semantic Access Control for Privacy Management of Personal Sensing in Smart Cities Michał Drozdowicz, Maria Ganzha, Marcin Paprzycki Abstract—Personal and home sensors generate valuable information that could be used in Smart Cities. Unfortunately, typically, this data is locked out and used only by application/system developers. While vendors are partially to blame, one should consider also the “binary nature” of data access. Specifically, either owner has full control over her data (e.g. in a “closed system”), or she completely looses control, when the data is “opened”. In this context, we propose, a semantic technologies-based, authorization and privacy control framework that enables user to maintain flexible, yet manageable data access control policies. The proposed approach is described in detail, including implementation and testing. Index Terms—Access control, semantic technologies, Smart City, data privacy, sensors, XACML, Attribute Based Access Control F 1 INTRODUCTION ANY Smart City projects rely on information collected assure the protection of privacy. Therefore, a successful M from public sensor networks monitoring, among oth- solution, gathering personal sensor information for public ers: traffic, parking availability, pollution, noise, etc. (see, use, should provide solid means of managing privacy pref- for instance, [1]). Examples, such as the city of Barcelona [2], erences and fine-grained access control. Here, let us note show benefits of such knowledge in governing the city, op- that while there exist ways of anonymizing data to make it timizing operational expenditures, and improving citizens’ less sensitive, research on removing user/data anonymity quality of life. However, the initial costs of such initiatives limits the relevance of such approaches [4], [5]. are very high, with major contributing factors including the Furthermore, as discussed in [6], when dealing with purchase and installation of sensors, infrastructure cost (e.g. health-related data and/or movement patterns extracted high-throughput network), or development and integration by fitness trackers, the actual challenge concerns relative of software. Moreover, introducing new “data sources” of- perception of privacy. Specifically, it involves not only which ten requires deploying new sensor networks, or upgrading data is to be shared, but also with whom and for what purpose. existing ones (both generating substantial costs). Finally, Finally, let us consider access to personal data by gov- to achieve the expected benefits, the ecosystem must be ernment agencies, e.g. related to criminal investigations, or maintained and adapted to follow changes in technology national security. Analysis by Nojeim et al. [7] shows that, and development and growth of the city. from legal and practical perspective, existing regulations Some of those shortcomings can be addressed by taking and tools fail to reconcile public security with basic human advantage of the rapidly growing number of personal, and rights and legal regulations (e.g. the GDPR). Therefore, home-based, IoT devices, therefore reducing the costs of when facing access requests, businesses storing the personal hardware infrastructure needed to gather data. Moreover, information rely on own judgment and/or interests, while the variety of citizen-owned sensing devices is system- agencies resort to broad, uncontrolled, and often unneces- atically increasing, generating new dimensions of useful sarily detailed, surveillance. knowledge. For instance, the popularity of fitness tracking The described problem is an instance of a more general solutions has lead to a massive growth of health and lifestyle topic of access control. It requires defining rules of who is related data, which could be used to improve the medical allowed to access data, the same way as a company defines and living conditions of the society. who can access a specific area in a building. Access control Obviously, motivating the citizens to share their data is well studied, and many approaches to solving it have “with the city” is a serious challenge, but it has been been suggested and implemented. Here, Access Control shown [3] that one of the key obstacles to achieving this Lists, Role Based Access Control or Attribute Based Access is “privacy management”. Specifically, how to facilitate ad- Control mechanisms have been created to tackle general- equate control over personal data, and thus convincingly ization of user roles and resource groups, static and dy- namic Separation of Duties, spatiotemporal authorization, etc. Acknowledging this, note that several specific aspects of • M. Drozdowicz, M. Ganzha and M. Paprzycki were with Systems Re- search Institute, Polish Academy of Sciences, Warsaw, Poland. privacy management in Smart Cities need to be addressed: Corresponding author: [email protected] • Access requester is, likely, an organization. Moreover, • M. Ganzha was with Department of Mathematics and Information Sci- the structure of the organization is, often, not known ence, Warsaw University of Technology, Warsaw, Poland. up-front. Hence, representation of (hierarchical) orga- 2 nizational structure is needed. Obviously, question of and cycling workouts. Thus far, she has collected data for identity verification arises, but it is out of scope of this personal benefits and shared it with friends (using some contribution. application). However, she is considering participation in • Data request is completed on behalf of an external a program analyzing sport activities in her home city. The organization, e.g. local government, which should be primary use case (UC1) concerns the local Health Center, allowed to access only some data. Hence, token-based wishing to investigate the workout and training habits of authorization (such as OAuth) is not feasible. the citizens. The second entity interested in her data (UC2) is • Considered data is often a series/stream of observa- the Police, investigating a crime in a certain area, searching tions that should be abstracted to types/categories, to for potential witnesses. For UC1 Sally would like to specify avoid authorizing them individually. However, due to (independently) what information, and at what level of de- differences between devices/services, enforcement of a tail, she will share. UC2 illustrates how the proposed system common observation vocabulary is not likely. Hence, handles legal obligations, while providing sufficient control use of access control mechanisms that depend on a over what data may be accessed under what conditions. fixed set of “scopes” (e.g. OAuth), may be challenging. To deliver the needed functionality, we will build upon • Potential (large) scale of social participation, cou- the semantically enriched Attribute Based Access Control pled with heterogeneity of data gathering applications, system, introduced in [8], [12], [13], and expand it with brings interoperability challenges that also materialize a more detailed model of privacy preferences, as well as in access authorization. Differences in data representa- means of handling legal access control policies. tion necessitate either (i) conversion of data to some Thus, in Section 3, we give an overview of the state- common format, which may not be feasible from closed of-the-art of solutions for enforcing privacy in Smart Cities data ecosystems (e.g. commercial fitness trackers), or as well as access control solutions making use of semantic (ii) introduction of a mapping layer. This would also technologies. Further, in Section 4, we briefly describe the result in authorization decisions involving centralized SXACML access control system and discuss how to design rules and policies. an ontology that can be used to manage privacy and trust • Time and location of issuing the request may not be in Smart City. Finally, in Section 5 we revisit our guiding essential, however certain spatiotemporal data related scenarios, to show in detail how proposed system enables to the accessed information may be of use. citizens to manage access to their personal data, using the • Legal access to data (e.g. governed by GDPR) must proposed system. be allowed, while rigorously controlled. Correspond- ing policies should consider purpose of use, retention routines, type of information, etc. 3 RELATED WORK In this context, in [8] we have proposed a semantically- 3.1 Privacy and access control enriched authorization system for fine-grained control of Let us first look into the methods of general access con- data access. Here, we expand on the idea, focusing on if and trol, in which authorization policies and rules are used to in what way ontological modeling, and semantic reasoning, validate if a Subject is permitted to perform an Action on can help manage privacy preferences in participatory sens- a Resource in a certain request Context. We purposefully ing, within Smart Cities. The proposed solution recognizes focus on the decision process and leave out consideration of that different information may be perceived as more or “orthogonal aspects”, such as identification, authentication, less private, depending