Harnessing Pseudonyms with Implicit Attributes for Privacy-Respecting Mission Log Analysis

Abstract

Abstract-Many applications in the area of collaborative work can be enhanced by tracking users regularly. Consider a future emergency management application, in which mobile first responders are continuously tracked in order to support a better coordination of the rescue missions and to create a mission log. However, continuous tracking of individuals and storing the data for later use is often in conflict with individual privacy preferences. Therefore, it is a challenge to deal with conflicting traceability and privacy protection requirements. A common way to implement some kind of privacy protection is to use pseudonyms instead of fixed IDs for each user. However, in order to build a multilateral secure and acceptable solution, a more complex system design w.r.t. to pseudonym linkability is required, that also allows third parties to analyze the logs for organizational and legal reasons.In this paper, we present our approach to deal with this issue: we propose to encode additional information into pseudonyms that are used in location tracking systems and stored in data logs. Our concept comprises both access rights for the user herself and implicit attributes that may be verified by third parties in a privacy-respecting manner. We introduce the cryptographic constructions, which employ cryptographically secure pseudorandom number generators, threshold cryptography and techniques for securely evaluating encrypted data. Moreover, in this paper, we sketch a practical application example in the area of emergency mission log analysis and discuss the main security properties of our concepts.

A novel policy-driven reversible anonymisation scheme for XML-based services

“…This scenario has the same weakness as the other pseudonymisers, since it may be vulnerable to trac analysis attacks in the intervals between rekeying of the pseudonymiser. Some of the ideas in this scheme have been extended to support multilaterally secure ubiquitous auditing in [27,26]. It combines transaction pseudonyms based on threshold cryptography with secure multiparty computations to support secure and privacy enhanced tracking of mobile rescue units.…”

MundoMessage

“…Also, we assume that potential receivers of messages continuously provide location information to the system. In order to deal with the inherent privacy issues [20,21] of this situation, we propose that location tracking proceeds under transaction pseudonyms. Yet, we also provide a technique for reidentification of role or specialization attributes implicitly attached to pseudonyms.…”

“…First, in order to generate transaction pseudonyms, a base pseudonym PU i ,B of a user Ui is initially created as an ElGamal encryption of an algebraic representation of the unique base identifier IDi (cp. [20,21]). Thus, ID ∈ Gq is non-deterministically encrypted by choosing r ∈R Zq and by computing (g r , h r IDi).…”

Multilaterally Secure Ubiquitous Auditing

“…by sending their GPS positions and further data to a headquarter, a precise coordination of rescue missions is possible [53] and vital signs of first responders can be monitored. Moreover, units can act as mobile sensors to monitor levels of air pollution, also mission auditing can be supported by creating digital mission logs based on the collected GPS traces [52].…”

“…We believe that it is a major challenge to design data security mechanisms that allow to reconcile the conflicting goals of accountability for legal and organizational reasons and individual privacy protection [55,54,52]. …”