A Survey on Understanding and Representing Privacy Requirements in the Internet-of-Things

Abstract

People are interacting with online systems all the time. In order to use the services being provided, they give consent for their data to be collected. This approach requires too much human effort and is impractical for systems like Internet-of-Things (IoT) where human-device interactions can be large. Ideally, privacy assistants can help humans make privacy decisions while working in collaboration with them. In our work, we focus on the identification and representation of privacy requirements in IoT to help privacy assistants better understand their environment. In recent years, more focus has been on the technical aspects of privacy. However, the dynamic nature of privacy also requires a representation of social aspects (e.g., social trust). In this survey paper, we review the privacy requirements represented in existing IoT ontologies. We discuss how to extend these ontologies with new requirements to better capture privacy, and we introduce case studies to demonstrate the applicability of the novel requirements.

PETRAS: a socio-technical framework for Internet of Things research and development

“…Privacy requirements specify the capabilities and functions that must be embedded in a system to protect the personal data of end users and to empower them with control of their data Ogunniye and Kokciyan (2023a). These requirements are generally based on fundamental privacy objectives specified in the relevant privacy regulatory policy or guidance, such as GDPR Voigt and Von Dem Bussche (2017).…”

“…The importance of the IoT is largely achieved through connected data, allowing objects or things to be readable, recognisable, locatable, addressable, and/or controllable over a network. Although this presents significant opportunities, the main areas of public concern about the technology include the potential impact of information flow on user privacy Ogunniye and Kokciyan (2023a), protection of data assets and the increased capabilities of IoT devices against unauthorised access and manipulations Ghafir et al (2018), how to minimise security and privacy risks to make the technology more acceptable, how to build public trust in the technology Mullagh et al (2022), and ethical problems such as profitability versus ethics, business versus politics Nehme et al (2022), among others.…”

“…It is vital that an adequate governance structure and policies are designed and implemented to enhance trust, protect privacy, and user security Mullagh et al (2022). Recently, there has been growing recognition that technical solutions alone cannot adequately address these public concerns systems Cath (2018); Nicolescu et al (2018); Ogunniye and Kokciyan (2023a); Buil-Gil et al (2023). The technical, social, cultural, and behavioural aspects of how we design, develop, manage, and evolve the IoT will be critical to its success Shin (2014).…”

Privacy-Enhanced AI Assistants Based on Dialogues and Case Similarity

“…As the application scenario shifts from sharing photos on social networks to the interaction between users and personal assistants, and even as users manage their privacy needs across multiple devices, context has become a focus for researchers [33,19,4]. This notion serves as the impetus for Kokciyan et al [23] to put forth a situation-based model for privacy protection.…”

Security models of the Internet of Things

“…Безпека IoT з акцентом на вплив нових технологій представлена у роботі [9]. Питання формування вимог безпеки до компонентів IoT розглядаються в [10,11]. Огляд заходів безпеки для IoT представлено в [12].…”