Understanding User Privacy in Internet of Things Environments IEEE WORLD FORUM ON INTERNET OF THINGS / 30

Transcription

1 Understanding User Privacy in Internet of Things Environments HOSUB LEE AND ALFRED KOBSA DONALD BREN SCHOOL OF INFORMATION AND COMPUTER SCIENCES UNIVERSITY OF CALIFORNIA, IRVINE IEEE WORLD FORUM ON INTERNET OF THINGS / 30

2 Agenda Introduction Related Work Privacy Preferences in IoT Privacy Preference Collection Privacy Preference Analysis Interpretation of Privacy in IoT Limitations and Future Work Conclusion IEEE WORLD FORUM ON INTERNET OF THINGS / 30

3 Introduction (1/4) Internet of Things (IoT) Networked computing environment consisting of diverse physical objects Collection of personal information with minimum user intervention Privacy in IoT IoT gives benefits, but can compromise user privacy Privacy is important issue for more widespread use of IoT Lack of efforts to fully understand users privacy concerns in IoT Home Automation in IoT Privacy Concerns in IoT IEEE WORLD FORUM ON INTERNET OF THINGS / 30

4 Introduction (2/4) Privacy Preference Collection We collected users privacy preferences about IoT scenarios via online survey IoT scenarios Privacy Preferences IEEE WORLD FORUM ON INTERNET OF THINGS / 30

5 Introduction (3/4) Privacy Preference Analysis We performed a cluster analysis on the collected privacy preferences We identified 4 distinct clusters of scenarios wrt. potential privacy risks IoT scenarios Privacy Preferences Clustered Preferences (K=4) K-modes clustering algorithm IEEE WORLD FORUM ON INTERNET OF THINGS / 30

6 Introduction (4/4) Interpretation of Privacy in IoT We found some relationships btw. IoT contexts and users privacy preferences IoT scenarios People have privacy concerns in case Privacy Preferences Clustered Preferences (K=4) Privacy-invasive Contexts in IoT K-modes clustering algorithm IEEE WORLD FORUM ON INTERNET OF THINGS / 30

7 Related Work Privacy Preference Analysis in UbiComp Privacy preference determinants in ubiquitous computing (ACM CHI 03) A survey of private moments in the home (ACM UbiComp 11) Capturing location-privacy preferences (Personal and Ubiquitous Computing 11) A personal location system with protected privacy in IoT (IEEE BNMT 11) Insights Identity of information requester is important No tracking personal behavior at home Full control of location sharing Active location sharing in emergency situations How people make privacy decisions in IoT environments? More diverse contextual factors need to be considered IEEE WORLD FORUM ON INTERNET OF THINGS / 30

8 Privacy Preferences in IoT 1. DATA COLLECTION 2. DATA ANALYSIS 3. INTERPRETATION IEEE WORLD FORUM ON INTERNET OF THINGS / 30

9 Data Collection (1/5) Previous Works 1 We defined contextual parameters that construct IoT scenarios where what who reason persistence We defined reaction parameters that indicate users privacy preferences _notification _permission _comfort _risk _appropriateness 1: HCI in Business: A collaboration with academia in IoT privacy (HCIB 2015) IEEE WORLD FORUM ON INTERNET OF THINGS / 30

10 Data Collection (2/5) Contextual Parameters A device of a friend (C 3 =3) records your voice to check your presence (C 2 =9). This happens once (C 5 =0), while you are at semi-public place (C 1 =2), for your safety (C 4 =1). Sample IoT Scenario IEEE WORLD FORUM ON INTERNET OF THINGS / 30

11 Data Collection (3/5) Reaction Parameters Would you want to allow this monitoring? Sample Question allow, always (R 2 =1) allow, just this time (R 2 =2) reject, just this time (R 2 =3) reject, always (R 2 =4) Sample Answer Options IEEE WORLD FORUM ON INTERNET OF THINGS / 30

12 Data Collection (4/5) Online Survey Study We recruited 200 participants on Amazon Mechanical Turk (MTurk) US resident, English speaker, high reputation at Amazon MTurk 100 females/99 males (1 unknown), majority (57.5%) are aged We educated them about IoT (e.g., definition, application scenario, etc) Online Survey System (Amazon MTurk) IoT IEEE WORLD FORUM ON INTERNET OF THINGS / 30

13 Data Collection (5/5) Online Survey Study (Cont d) We created scenarios via random permutation of contextual parameter values We individually asked for their reactions and opinions on the given scenarios We collected privacy preferences for 2,800 IoT scenarios IoT Scenario A device of a friend records your voice to check your presence. This happens once, while you are at semi-public place, for your safety. Online Survey System (Amazon MTurk) Question Would you want to allow this monitoring? Privacy Preference I m willing to allow it just this time. Participants IEEE WORLD FORUM ON INTERNET OF THINGS / 30

14 Data Analysis (1/5) K-means Clustering Algorithm Most popular data mining technique to partition observations into K clusters Restricted to continuous numeric values (e.g., , , ) K-modes Clustering Algorithm Variant of K-means to directly cluster categorical data Replacing cluster means with modes Using the simple matching dissimilarity function instead of the Euclidean distance function Updating modes with the most frequent categorical attributes in each clustering step Contextual Parameters Reaction Parameters K-means K-modes C 1 C 2 C 3 C 4 C 5 R 1 R 2 R 3 R 4 R Our Dataset IEEE WORLD FORUM ON INTERNET OF THINGS / 30

15 SE Data Analysis (2/5) Selecting the Number of Clusters We heuristically searched for the optimal K We computed the sum of errors (SE) of the clustering while increasing K from 2 to 10 SE is the sum of the distance btw. each member of the cluster and the cluster s centroid where x is a data point belonging to the ith cluster and c i is the mode of the ith cluster We found the largest decrease in errors (SE K-1 - SE K ) occurs when we increase K from 3 to 4 Sum of Errors Largest Error Decrease (K=4) K IEEE WORLD FORUM ON INTERNET OF THINGS / 30

16 Data Analysis (3/5) Clustering Results 4 clusters differ from each other primarily in contextual parameters: what (C 2 ) and who (C 3 ) Each mode has unique and identical values for reaction parameters: _comfort (R 3 ), _risk (R 4 ), _appropriateness (R 5 ) Modes of Clusters IEEE WORLD FORUM ON INTERNET OF THINGS / 30

17 Data Analysis (4/5) Labeling of Clusters We labeled each cluster using reaction parameters R 3, R 4, R 5 E.g., cluster 1 as Acceptable because its mode has the second highest value for R 3, R 4, R 5 We assigned colors to clusters green (CL 1 ), yellow (CL 2 ), red (CL 3 ), black (CL 4 ) Cluster distribution Acceptable (12.6%) vs. Very Unacceptable (40.8%) 1 Very inappropriate 2 Inappropriate 3 Somewhat inappropriate 4 Neutral 5 Somewhat appropriate 6 Appropriate 7 Very appropriate _appropriateness (R 5 ) Modes of Clusters IEEE WORLD FORUM ON INTERNET OF THINGS / 30

18 "_APPROPRIATENESS" 1: very inappripriate, 4: neutral, 7: very appropriate) Data Analysis (5/5) Verification of Clustering Results Welch s t-tests on reaction parameters in {CL 1, CL 2 }, {CL 2, CL 3 }, {CL 3, CL 4 } Reaction parameter values between each pair of clusters are statistically distinct (p < 0.016) Clusters are distinct from each other in terms of user reactions to the scenarios Information visualization We projected all data entries onto a 2-d space using R 5 values as their coordinates Scenarios that respondents deemed appropriate (R 5 =6, 7) mostly became clustered into CL 1 (green) Visualization of Clustering Results "_APPROPRIATENESS" (1: very inappripriate, 2: inappropriate, 3: somewhat inappropriate, 4: neutral, 5: somewhat appropriate, 6: appropriate, 7: very appropriate) Scenarios that respondents deemed very inappropriate (R 5 =1) mostly became clustered into CL 4 (black) HOSUB LEE ADVANCEMENT TO CANDIDACY 18 / 30

19 "WHERE" PARAMETER Interpretation where Findings Monitoring at personal places is very unacceptable Monitoring at public spaces is unacceptable Monitoring at semi-public spaces is somewhat unacceptable p: chi-square test of association d: effect size (large if d > 0.6) [CL4] Very unacceptable [CL3] Unacceptable [CL2] Somewhat unacceptable [CL1] Acceptable 3: public space p <.0001, d = : semi-public space p <.0001, d = : someone else's place 0: your place p <.0001, d = % 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% RELATIVE FREQUENCY IEEE WORLD FORUM ON INTERNET OF THINGS / 30

20 RELATIVE FREQUENCY Interpretation what (1/2) Findings Gaze monitoring is very unacceptable Photo-taking or video monitoring is unacceptable 100% [CL4] Very unacceptable [CL3] Unacceptable [CL2] Somewhat unacceptable [CL1] Acceptable 90% 80% 70% 60% 50% 40% 30% 20% p <.0001, d = p = , d = % 0% "WHAT" PARAMETER IEEE WORLD FORUM ON INTERNET OF THINGS / 30

21 RELATIVE FREQUENCY Interpretation what (2/2) Findings Voice monitoring for gender and location awareness is tolerable Personally identifiable information (e.g., phone ID) is okay to share p <.0001, d = % 90% 80% [CL4] Very unacceptable [CL3] Unacceptable [CL2] Somewhat unacceptable [CL1] Acceptable p = , d = % 60% 50% 40% 30% 20% 10% 0% "WHAT" PARAMETER IEEE WORLD FORUM ON INTERNET OF THINGS / 30

22 "WHO" PARAMETER Interpretation who (1/2) Findings Monitoring by unknown entity is very unacceptable Monitoring by government or nearby business is unacceptable [CL4] Very unacceptable [CL3] Unacceptable [CL2] Somewhat unacceptable [CL1] Acceptable 7. government p <.0001, d = employer/school 5. business p <.0001, d = own device 3. friend 2. colleague 1. unknown p <.0001, d = % 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% RELATIVE FREQUENCY IEEE WORLD FORUM ON INTERNET OF THINGS / 30

23 "WHO" PARAMETER Interpretation who (2/2) Findings Monitoring by friends is fine Monitoring by own devices is acceptable [CL4] Very unacceptable [CL3] Unacceptable [CL2] Somewhat unacceptable [CL1] Acceptable 7. government 6. employer/school 5. business 4. own device p <.0001, d = friend p <.0001, d = colleague 1. unknown 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% RELATIVE FREQUENCY IEEE WORLD FORUM ON INTERNET OF THINGS / 30

24 "REASON" PARAMETER Interpretation reason (1/2) Findings Purposeless IoT services are unacceptable Some purposeless scenarios are still considered acceptable [CL4] Very unacceptable [CL3] Unacceptable [CL2] Somewhat unacceptable [CL1] Acceptable 6. not specified p <.0001, d = health 4. convenience 3. social 2. commercial 1. safety 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% RELATIVE FREQUENCY IEEE WORLD FORUM ON INTERNET OF THINGS / 30

25 "REASON" PARAMETER Interpretation reason (2/2) Findings Convenience is the most significant reason to allow monitoring Safety is also a reasonable justification to allow monitoring [CL4] Very unacceptable [CL3] Unacceptable [CL2] Somewhat unacceptable [CL1] Acceptable 6. not specified 5. health 4. convenience 3. social 2. commercial 1. safety 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% RELATIVE FREQUENCY IEEE WORLD FORUM ON INTERNET OF THINGS / 30

26 "PERSISTENCE" PARAMETER Interpretation persistence Findings No clear tendency was observed Participants have privacy concerns about continuous monitoring in general [CL4] Very unacceptable [CL3] Unacceptable [CL2] Somewhat unacceptable [CL1] Acceptable 1. continuously 0. once 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% RELATIVE FREQUENCY IEEE WORLD FORUM ON INTERNET OF THINGS / 30

27 Limitations and Future Work (1/2) Out-of-Context Attitudinal Study Some contextual parameters were coarsely defined E.g., someone else s place might be interpreted differently by participants Participants responded at a location that has no association w/ the scenarios Decreased sense of realism to the scenarios IoT at School? A device of a friend (C 3 =3) records your voice to check your presence (C 2 =9). This happens once (C 5 =0), while you are at someone else s place (C 1 =1), Where is this? for your safety (C 4 =1). IoT Scenario Survey at Home IEEE WORLD FORUM ON INTERNET OF THINGS / 30

28 Limitations and Future Work (2/2) Location-based Survey Simulation of user experience in virtual IoT environments Creating realistic IoT scenarios mapped to real locations through crowdsourcing Building wearable system presents the IoT scenarios related to users current locations Asking users to answer questions on the scenarios while walking around a specific area Wearable Computer Location Awareness Survey IEEE WORLD FORUM ON INTERNET OF THINGS / 30

29 Conclusion In This Paper We aimed to understand user privacy in IoT environments We collected people s privacy preferences toward IoT via online survey We analyzed the collected survey responses via data mining technique IoT scenarios can be grouped into 4 clusters wrt. their potential privacy risks Clustering results are statistically and visually sound We uncovered contextual factors impact people s privacy perceptions who and what are the most important factors We plan to conduct location-based survey study (field experiments) More suitable for collecting sincere responses from users than a traditional survey IEEE WORLD FORUM ON INTERNET OF THINGS / 30

30 Thank You! ANY QUESTIONS? IEEE WORLD FORUM ON INTERNET OF THINGS / 30