Towards a Model of User-centered Privacy Preservation

Abstract

The growth in cloud-based services tailored for users means more and more personal data is being exploited, and with this comes the need to better handle user privacy. Software technologies concentrating on privacy preservation typically present a one-size fits all solution. However, users have different viewpoints of what privacy means to them and therefore, configurable and dynamic privacy preserving solutions have the potential to create useful and tailored services without breaching any user's privacy. In this paper, we present a model of user-centered privacy that can be used to analyse a service's behaviour against user preferences, such that a user can be informed of the privacy implications of that service and what fine-grained actions they can take to maintain their privacy. We show through a case-study that the user-based privacy model can: i) provide customizable privacy aligned with user needs; and ii) identify potential privacy breaches. CCS CONCEPTS Security and privacy → Domain-specific security and privacy architectures; Social and professional topics → Privacy policies; Computer systems organization → Cloud computing;

PAX: Using Pseudonymization and Anonymization to Protect Patients’ Identities and Data in the Healthcare System

“…Extensible access control markup language (XACML) standards include both access control (authorisation) and data management based on XML in the different systems [25]. Effectively, XACML offers features for data access and authorisation for the users at the fine-grained level, which is the most flexible and effective [26,27,28]. This technology is presented by the organization for the advancement of structured information standards (OASIS).…”

A Socio-Technical and Co-evolutionary Framework for Reducing Human-Related Risks in Cyber Security and Cybercrime Ecosystems

“…An important aspect of this project is to provide a simple privacy dashboard for end users, allowing them to control their privacy settings in their regularly used platforms. A tool called PlusPrivacy [2] has been launched as a web or smart phone app as part of the OPERANDO project, which allows users to specify their privacy preferences in online social networks, for purposes such as blocking ads, malware, tracker, unwanted apps or extensions, and hiding their email identities [24].…”

Pseudonymization risk analysis in distributed systems

“…Hence, a user's privacy changes if any of their personal data has been or can be identified by an actor. Prior models following this approach are: a Finite State Machine (FSM) [10,11] or a Labelled Transition System (LTS) [12]. The common theme in both is that the user's privacy at any point in time is represented by a state, and that actions, executed by actors, taken on their personal data can change this state.…”

“…As they control more aspects of the system than just pseudonymization, for a more detailed description refer to literature describing the system overall [12]. These policies, which are derived from information obtained from a questionnaire, have three main aspects:…”