Privacy-Preserving Identifiers for IoT: A Systematic Literature Review

Abstract

The Internet of Things (IoT) paves the way for smart applications such as in E-health, Ehomes, transportation, or energy production. However, IoT technologies also pose privacy challenges for their users, as they allow the tracking and monitoring of the users' behavior and context. The EU General Data Protection Regulation (GDPR) mandates data controller to follow a data protection by design and default approach by implementing for instance pseudonymity for achieving data minimisation. This paper provides a systematic literature review for answering the question of what types of privacy-preserving identifiers are proposed by the literature in IoT environments for implementing pseudonymity. It contributes with classifications and analyses of IoT environments for which privacy-preserving identifiers have been proposed and of the pseudonym types and underlying identity management architectures used. Moreover, it discusses trends and gaps in regard to addressing privacy trade-offs.

Privacy-Preservation Techniques for IoT Devices: A Systematic Mapping Study

“…Akil et al [1] present a systematic literature review on the use of privacy-preserving identifiers implementing pseudonymity in identity management systems for IoT published from 2009 to 2019. Privacy-preserving identifiers are information containers used to identify or authorize a user and/or a device without necessarily revealing the identity or other personal details of the device holders.…”

“…More precisely, our work differs from the current work in the following respects: (i) we retrieve and analyze a larger number of primary studies compared to the other studies; (ii) we follow a systematic procedure to carry out our study. No study, except the works of Alkil et al [1], followed a systematic procedure. Alkil et al [1] presented fewer research questions, retrieved fewer primary studies, and considered fewer search engines compared to our work; (iii) we focus only on PP techniques for IoT devices.…”

“…The Internet of Things (IoT) as a pervasive technology is now entangled in everyday life, from "smart" vehicles that communicate with each other and vacuum cleaners that create blueprints of homes to watches that track calories burnt and light bulbs controlled over the Internet. Its pervasiveness also implies that all data that are produced or handled by IoT devices can be used to directly or indirectly draw conclusions on personal behaviour and preferences [1]. However, these applications may expose a mobile user to various privacy and security threats.…”

“…To date, various PP strategies have been proposed by researchers to overcome certain privacy threats [10]. We identified several recent survey papers, which discuss PP techniques involving IoT devices [1]- [3], [10], [11], [13], [14]. However, to the best of our knowledge, no systematic literature reviews on PP techniques for IoT devices have been published.…”

Privacy Technologies and Policy

“…In light of the above requirements, data pseudonymisation plays an important role in data protection. From an engineering perspective, a pseudonym is defined as an identifier of a subject, which is different from the subject's real name [32,1], whereas the types of pseudonyms may be distinguished by the context of use [32]. Typically, a pseudonym replaces a data subject's identifier, with the latter one being able to explicitly identify the data subject within a specific context; for example, the original identifier can be a combination of first name and last name, an e-mail address, or even a device/network identifier (e.g.…”