Understanding and Minimizing Identity Exposure in Ubiquitous Computing Environments

Abstract

Various miniaturized computing devices that store our identities are emerging rapidly. They allow our identity information to be easily exposed and accessed via wireless networks. When identity information is associated with our personal and context information that is gathered by ubiquitous computing devices, personal privacy might be unprecedentedly sacrificed. People, however, have different privacy protection skills, awareness, and privacy preferences. Individuals can be uniquely identified on the basis of only a few identity elements used in combination. To the best of our knowledge, this is the first study to understand the following issues and their relations: a) what identity elements people think are important; b) what actions people claim to take to protect their identities and privacy; c) privacy concerns; d) how people expose their identities in ubiquitous computing environments; and e) how our rational identity exposure model can help to minimize identity exposure. We build a simulated ubiquitous computing shopping system, called InfoSource. It consists of two applications and our rational identity exposure model. We present our experiments and statistical analysis results. Our data show that exposure decisions depend on participants' attitudes about maintaining privacy, but they do not depend on participants' concerns and claimed actions related to identity exposure. Our RationalExposure model helped participants to minimize unnecessary exposures.Index Terms-game theory, identity management, privacy, ubiqitous computing I.

Reciprocity attacks

“…We used InfoSource V3.0 in the experiments, which provided more interactive and a smoother user experience than InfoSource V1.0 that we used in another study [8]. An animated recommendation agent, Alice, introduced herself and greeted the user as shown in Figure 1 (a).…”

“…Our earlier work focused on identity exposure in mobile and pervasive computing environments [8]. Specifically, we conducted an extensive survey and experiments on five aspects of identity exposure: (a) identity elements that people think are important to keep private (their attitudes); (b) their privacy concerns; (c) actions people claim to take to protect their identities and privacy; (d) people's identity exposure behavior in mobile and pervasive computing environments; and (e) whether rational suggestions can help people avoid unnecessary identity exposure by using our RationalExposure model [24].…”

“…A few recent studies [7], including our earlier work [8], suggest that people are less aware of the privacy issues raised by mobile and pervasive computing. While people cannot protect their privacy well under benign circumstances, conditions in which privacy is attacked may cause even more serious problems.…”

“…Across several pilot studies and experiments, 167 participants came to our lab to participate in the research. We selected identity elements with different levels of sensitivity, based on our previous study [8], to determine how reciprocity attacks impact the disclosure of various types of private information. Requests for the identity elements were embedded as different types of reciprocity attacks, suggesting exchange of personal information for information, products, or services.…”

Measuring attitude towards personal data for adaptive cybersecurity

“…The trend is mediated by technologies such as smartphones, social networking, and smart-meters (Manyika et al, 2015). Previous work has highlighted that personal privacy is more vulnerable to erosions when contextual and personal information is gathered by pervasive computing systems (Beresford, 2005, Zhu et al, 2009. Although personal data is recognized as a key issue requiring innovative cybersecurity measures within the digital economy, there are comparatively few studies exploring individuals' attitudes towards it.…”