Privacy for the Personal Data Vault Information Systems and Computer Engineering

102 Pages·2014·1.28 MB·English

Privacy for the Personal Data Vault

Tamás Balogh

Thesis to obtain the Master of Science Degree in
Information Systems and Computer Engineering

Supervisors: Prof. Ricardo Jorge Fernandes Chaves
Master Researcher Christian Schaefer

Examination Committee
Chairperson: Prof. Luís Eduardo Teixeira Rodrigues
Supervisor: Prof. Ricardo Jorge Fernandes Chaves
Member of the Committee: Prof. Nuno Miguel Carvalho dos Santos

July 2014
Acknowledgments
First of all I would like to thank Ericsson for providing me with the opportunity to work on this
interesting research project. Special thanks goes out for Christian Schaefer for his great support
during the thesis work.
I would like to thank my thesis supervisor, Prof. Ricardo Chaves for his help and valuable
feedback during the course of this work.
My gratitude also goes out for the European Masters in Distributed Computing program co-
ordinator, Prof. Johan Montelius, Prof. Lu´ıs Rodrigues and Prof. Lu´ıs Veiga, who guided me
throughout my masters’ program.
Last but not least, I would like to thank my family and friends for supporting me all along.
Abstract
Privacy is an important consideration in how online businesses are conducted today. Personal
user data is becoming a valuable resource that service providers collect and process ferociously.
The user centric design, that stands for the basis of the Personal Data Vault (PDV) concept, is
trying to mitigate this problem by hosting data under strict user supervision. Once the user’s data
leaves its supervision, however, the current privacy models offered for the PDV are no longer
enough. The goal of this thesis is to investigate different privacy enhancing techniques that can
be employed in the scenario where PDVs are used. We propose three different privacy enhancing
models, all based around the use of the Sticky Policy (policy attached to data, describing usage
restrictions) paradigm. Two of these models are inspired by previous research, while the third one
is our novel approach that turns a simple Distributed Hash Table (DHT) into a privacy enforcing
platform. We perform several evaluations of the proposed models, having different aspects in
mind, such as: feasibility, trust model, and weaknesses.
Keywords
Personal Data Vault, privacy, Sticky Policy, trust, assurance
iii
Resumo
A privacidade e´ um aspecto importante a ter em considerac¸a˜o na forma como as trocas com-
erciais sa˜o realizadas hoje em dia. Os dados pessoais esta˜o a tornar-se um recurso valioso
que os fornecedores de servic¸os recolhem e processam copiosamente. Um design centrado ni
utilizador, e´ a base do conceito do “Personal Data Vault (PDV)”, que tenta mitigar este problema,
acolhendo estes dados pessoais sob estrita supervisa˜o do utilizador. No entanto, assim que o
utilizador deixa de realizar esta supervisa˜o, o modelo de privacidade actualmente disponibilizado
pelo PDV deixa de ser suficiente. O objectivo desta dissertac¸a˜o e´ investigar diferentes te´cnicas
de reforc¸o desta privacidade, que podera˜o ser aplicadas nas situac¸o˜es onde os PDVs sa˜o us-
ados. Seguidamente sa˜o propostos treˆs modelos de privacidade reforc¸ada, todos baseados no
paradigma do uso de “Sticky Policy” (pol´ıticas associadas aos dados, descrevendo as restric¸o˜es
a` sua utilizac¸a˜o). Enquanto, dois destes modelos sa˜o inspirados no estado da arte existente, o
terceiro constitui uma nova abordagem que transforma um simples Distributed Hash Table (DHT)
numa plataforma de privacidade reforc¸ada. Foram realizadas va´rias avaliac¸o˜es aos modelos
propostos, tendo em mente diferentes aspectos, tais como: viabilidade, confianc¸a e debilidades.
Palavras Chave
Personal Data Vault, privacidade, Sticky Policy, confianc¸a, garantia
v
Contents
1 Introduction 1
1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2 Problem Statement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.4 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.5 Thesis Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.6 Dissertation Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
2 Background 7
2.1 The Personal Data Vault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1.1 PDV as an Abstraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.1.2 PDVs in the Healthcare System . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.2 Personal privacy concerns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3 Related Work 15
3.1 XACML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.2 Usage Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.2.1 UCON in practice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
3.3 TAS3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3.4 PrimeLife . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
3.5 Other Privacy Enforcement Techniques . . . . . . . . . . . . . . . . . . . . . . . . 23
3.5.1 DRM approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
3.5.2 Trusted platform . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.5.3 Cryptographic techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
3.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
4 System Design 27
4.1 PrimeLife Policy Language (PPL) Integration . . . . . . . . . . . . . . . . . . . . . 28
4.2 Verifiable Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
vii
Contents
4.2.1 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.2.2 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4.2.3 Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
4.2.4 Privacy Manager Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.2.4.A Verifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
4.2.4.B Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
4.2.5 Interaction Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.2.5.A Data Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
4.2.5.B Forwarding Chain . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
4.3 Trusted Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
4.3.1 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.3.2 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.3.3 Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
4.3.4 Privacy Manager Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . 39
4.3.4.A Trust Negotiator . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
4.3.4.B Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.3.5 Interaction Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.3.5.A Data Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
4.3.5.B Forwarding Chain . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
4.4 Mediated Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
4.4.1 Description . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
4.4.2 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
4.4.3 Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
4.4.4 DHT Peer Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
4.4.4.A The Remote Retrieval Operation . . . . . . . . . . . . . . . . . . . 46
4.4.4.B Membership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
4.4.4.C Keyspace Assignment . . . . . . . . . . . . . . . . . . . . . . . . . 48
4.4.4.D Business Ring Size . . . . . . . . . . . . . . . . . . . . . . . . . . 49
4.4.4.E Business Ring Description . . . . . . . . . . . . . . . . . . . . . . 49
4.4.5 Privacy Manager Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
4.4.5.A Sticky Policy Enforcement . . . . . . . . . . . . . . . . . . . . . . . 50
4.4.5.B Trust Management . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
4.4.6 Logging Layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
4.4.7 Interaction Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
4.4.7.A Data Flow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
4.4.7.B Multiple Data Subject (DS) Interaction Model . . . . . . . . . . . . 54
4.4.7.C Multiple Data Controller (DC) Interaction Model . . . . . . . . . . . 55
viii