Abstract

The IoT market is continuously expanding, and security measures parallel to the growing industrialization has drawn the research community’s attention. While several works have focused on the different technologies used to protect IoT devices, this paper aims to narrow the focus to Blockchain and Artificial Intelligence (AI) solutions for security and privacy issues faced by these devices. These technologies address two major vulnerabilities with edge devices on IoT networks: centralization and weak edge nodes. Blockchain provides a distributed system that can help avoid a single-point failure and can be used to optimize battery life on low-level devices by load balancing. On the other hand, AI’s power to learn and adapt is critical to automate systems and make them intelligent enough to analyze collected data. The combination of these two technologies is capable of mitigating multiple challenges IoT architectures face currently. The paper discusses the latest major architectures that integrate Blockchain and AI to enhance security within the. This paper also presents the comprehensive take on the device security and drawbacks to these mechanisms. This work also addresses the future of security in IoT and suggests different areas that need further work to better comprehend how the combination of these technologies can assist in enhancing security.

INTRODUCTION

The Internet of Things (IoT) market, a network of devices that communicate and exchange data with each other, has expanded over the last decade. IoT devices provide different applications such as health care, smart homes, wearables, and smart cities. The advent of a wide range of devices requires security that matches its capabilities to ensure the safety of the system and network. The number and type of attacks carried out against IoT devices have increased exponentially. As the need for faster and more efficient devices increases, there is a lag in equal breakthroughs in IoT security. According to Business Insider’s 2020 IoT research, IoT devices are predicted to increase to 41 billion by 2027 [1].

In order to meet this challenge, we must focus on the security strategies that match IoT devices’ hardware and computational power to minimize internal or outsider attacks.

CONCLUSION

This paper defined the role that AI/ML and Blockchain have currently in IoT devices, explaining in detail how Blockchain technology works and how AI/ML is used to lessen the computational load on IoT devices. We then talked about Blockchain and AI/ML in IoT security and how having these technologies strengthens privacy, data integrity, and data processing. Four potential solutions were explored and analyzed to understand how they could help deficiencies in the current IoT network setup as well as challenges that were not addressed in the solutions. Finally, future lanes of research were brought up for researchers to study.

This paper presented the role that AI/ML and Blockchain have currently in IoT devices and how these two can work in tandem to lessen the computational load on IoT devices. The paper then discussed the scope of Blockchain and AI/ML in IoT security towards strengthening privacy, data integrity, and data processing. Then it addresses the vulnerabilities and feasibility of AI/ML and Blockchain towards IoT security. With several potential solutions, four major works were studied. The paper then progresses to analyze these works on several parameters, summarizing them based on their: 1) Feasibility, 2) Security Strength, 3) Applicability and 4) Robustness.

1- Introduction

2- Related work

3- Preliminary

4- Game model and formulation

5- User’s response to privacy leakage

6- Game analysis based on Nash bargaining

7- Conclusion

References

Abstract

By exploiting rich personal information, Internet of Things can provide users with various customized experience and services, improving entertainment, convenience and quality for users’ life. However, unavoidably, these users suffer from serious risk of privacy leakage in the presence of untrusted service provider and malicious adversary. Game theory is treated as one of the most promising methodologies to investigate participants’ incentive, response, and behaviors and has been widely applied to design privacy preserving schemes. Nevertheless, the complex interactions among users, service provider, and adversary are not fully investigated in the existing work. What’s more, users’ social connection and interaction are ignored. In this paper, such complex interactions are modeled as a three-party game for the problem of private data trading in IoT with considering user’s social interaction in online social network. Particularly, data trading between service provider and adversary is formulated to be a Nash bargaining game, for which Nash bargaining solutions are analyzed via both theoretical analysis and numerical experiments. Our analysis can clearly illustrate data trading strategies between service provider and adversary and offer guidance for designing privacy protection scheme in IoT.

Introduction

Internet of Things (IoT) has achieved rapid development and promoted many emerging applications in recent years. With ubiquitous IoT devices, about 2.5 quintillion bytes of data are produced in every day [1]. According to estimation of Ahmed et al. [2], there will be 50 billion IoT devices in 2020. When people use IoT services, a lot of sensitive and personal information is uploaded to the service providers, such as personal profiles, sensors data of mobile terminal, and photos [3]. However, usually, users are not aware of how the service provider use their data and who could access their data clearly. Untrusted service providers may sell user’s data to third-party adversaries for extra profit without user’s permission. In 2018, Facebook admitted that an App related to Cambridge Analytica to harvest personal data of up to 87 million Facebook users without their consent [4]. And some OSNs, including twitter, Myspace and LiveJournal, also share user’s personally identifiable information to third parties [5]. Moreover, the study of Enck et al. [6] found that 15 out of 30 popular network services sent user’s information to remote advertisement or analytics servers. In the presence of untrusted service providers and adversaries, IoT users are suffering from severe risk of privacy leakage. As a new kind of IoT, social IoT (SIoT) has become popular [7,8], where the owners of IoT devices are also connected via online social network (OSN). That is, SIoT can be treated as the integration of IoT and OSN. In 2017, there are 2.46 billion social network users around the world, and it is estimated that the number of users will increase to 3.02 billion in 2021 [9].

1- Introduction

2- Theoretical framework

3- Method

4- Results

5- Discussion

References

Abstract

Research shows that people’s use of computers and mobile phones is often characterized by a privacy paradox: Their self-reported concerns about their online privacy appear to be in contradiction with their often careless online behaviors. Earlier research into the privacy paradox has a number of caveats. Most studies focus on intentions rather than behavior and the influence of technical knowledge, privacy awareness, and financial resources is not systematically ruled out. This study therefore tests the privacy paradox under extreme circumstances, focusing on actual behavior and eliminating the effects of a lack of technical knowledge, privacy awareness, and financial resources. We designed an experiment on the downloading and usage of a mobile phone app among technically savvy students, giving them sufficient money to buy a paid-for app. Results suggest that neither technical knowledge and privacy awareness nor financial considerations affect the paradoxical behavior observed in users in general. Technically-skilled and financially independent users risked potential privacy intrusions despite their awareness of potential risks. In their considerations for selecting and downloading an app, privacy aspects did not play a significant role; functionality, app design, and costs appeared to outweigh privacy concerns.

Introduction

At the time of publication, the number of smartphone users worldwide was just shy of 4.5 billion, with projections for the number of mobile phone users expected to reach the 5 billion mark by 2020 (Statista, 2019). Smartphone users store information and surf online, and by doing so collect (and distribute) large amounts of information. For billions of people around the world, the smartphone has become an indispensable daily companion. For many, the device remains within reach even while sleeping. Some researchers even argue that mobile phones can be seen as an extension to the human body (Shklovski et al., 2014). Because of their round the clock close proximity, smartphones can provide private behavioral information, including location, fitness, both on– and offline activities, social networking operations, and even audio-visual recordings (Aditya et al., 2014). However, most of this data aggregation is not voluntarily or consciously established by the end-user but initiated by business models based on data generation (Buck et al., 2014). By downloading and installing apps, smartphone users increase the risks associated with design flaws, malware attacks, and data theft. From a technical standpoint, the security and privacy risks associated with mobile applications have long been a cause for concern. By requesting irrelevant permissions, loosely defining permissions, or misusing permissions, combined with highly personalized data aggregation, mobile apps can and actually do provide third parties with sensitive data (Buck et al., 2014; Egele et al., 2011; Enck et al., 2014). Most mobile users are unaware of these threats to their personal data or unable to understand the technical mechanisms behind data leakage (Acquisti et al., 2016). Consequently, information exchanged between electronic devices can be used for user monitoring, leading to a generally wary user attitude towards the credibility of a smartphone’s privacy protection mechanisms. Although users might have ominous feelings when sharing information online, they still download and use apps in exchange for financial benefits, personalized services, or enjoyment in any way (Shklovski et al., 2014). Despite a foreboding feeling many users express, the number of mobile app downloads worldwide increases continuously (Statista, 2019). It seems that users download and install mobile applications without hesitation, even if apps require excessive permissions.

With the advances of data mining and the pervasiveness of cloud computing, online medical diagnosis service has been extensively applied in e-heathcare field, and brought great conveniences to people’s life. However, due to the insufficient data sharing among healthcare centers under the security and privacy concerns of medical information, the flourish of online medical diagnosis service still faces many severe challenges including diagnostic accuracy issues. In this paper, in order to address the security issues and improve the accuracy of online medical diagnosis service, we propose a new privacy-preserving collaborative model learning scheme with skyline computation, called PCML. With PCML, healthcare centers can securely learn a global diagnosis model with their local diagnosis models in the assistance of cloud, and the sensitive medical data of each healthcare center is well protected. Specifically, with a secure multi-party vector comparison algorithm (SMVC), all local diagnosis models are encrypted by their owners before being sent to the cloud, and can be directly operated without decryption. Detailed security analysis shows that PCML can resist security threats in the semi-honest model. Moreover, PCML is implemented with medical datasets from UCI machine learning repository, and extensive simulation results demonstrate that PCML is efficient and can be implemented effectively.

Introduction

In recent years, the online medical diagnosis system [1], which can provide medical diagnosis service anywhere and anytime, has attracted considerable interest. Compared with traditional treatment methods, online medical diagnosis is more flexible and convenient since it breaks the geographical restriction, and reduces the waiting time of seeing doctors [2]–[6]. To predict hidden diseases from collected medical data, many data mining techniques have been developed for e-healthcare system in recent years. For example, skyline computation [7], which returns a set of interesting points from a potentially huge data space, can be appropriately used in medical data analyzing and disease classification [6]. Specifically, with collected medical data, healthcare centers can generate diagnosis models via medical data mining with skyline query, which assists them in offering online medical diagnosis services, and allows users to check their health conditions expediently. Unfortunately, in traditional online medical system, the medical data are commonly stored distributively in different healthcare centers, and a sole healthcare center collecting only a small set of medical data cannot generate a skyline diagnosis model accurate enough [8], [9]. For example, consider the scenario shown in Fig. 1, when a user accesses online medical diagnosis services from multiple healcare centers, due to the limitation of diagnosis model accuracy, healthcare centers may not be able to diagnose diseases accurately, which will bring bewilderment to the user.

1- Introduction

2- Decentralized Online Social Networks: overview and key research challenges

3- Social data representation: an overview

4- Data availability

5- Information diffusion

6- Privacy and Security

7- DOSNs: current proposals

8- Conclusions and open problems Conflict of Interests

References

Abstract

The widespread diffusion of Online Social Networks has given unforeseen opportunities for their users to share contents and mutually interact. However, current platforms offer inadequate guarantees as far as concerns the privacy of their users. To address these issues and leave to the users more control on their data, several recent proposals suggest to decentralize the storage of social data, aiming at leaving their control entirely to their owners. This approach has lead to the definition of Decentralized Online Social Networks (DOSNs), ranging from completely decentralized solutions, i.e. P2P solutions, to hybrid systems integrating external and private resources for storing user data. While DOSNs allow users to have more control over their data, they raise new challenges concerning the management and availability of social data. Guaranteeing data availability in a highly dynamic environment, defining proper algorithms for information diffusion and guaranteeing data privacy in a distributed setting are currently open problems in this area. This survey presents an overview of these challenges and of the main solutions presented in the literature. Existing proposals are classified taking into account the strategies adopted to manage social data, focusing on the data availability and on information diffusion. The survey also presents the new privacy issues arising in DOSNs. Finally, an overview of the main open issues in this research area is presented.

Introduction

Online Social Networks (OSNs) are nowadays one of the most popular applications in the Internet. They have attracted a huge amount of users during the last years by changing the way people communicate and interact. Facebook can be considered the most representative OSN with, at the beginning of 2018, more than 2 billion active users, and the highest number of daily users connections. OSNs provide several services [1] offering to their users the opportunity of building a public profile, looking up new friends among the registered users, establishing relationships, and sharing content. Furthermore, these platforms also allow sharing of information within groups of users and the possibility of building communities of users characterized by common interests. One of the major problems of current OSNs, which are mainly developed on centralized platforms, concerns the privacy of the users’ data. Indeed, social data are stored in centralized servers, and the companies running the OSNs, use these data for commercial goals. In May 2015, a report1 commissioned by the Belgian Data Protection Authority based on the analysis of OSN policies and terms-of-use, concluded that Facebook gives users a false sense of control over their data privacy. More recently, it has been evident to the general public that Facebook data might have been sold without any consent of the legitimate owners. These are only few examples of several legal issues that involve not only Facebook, but also further OSNs, like Twitter, or Google+. Furthermore, centralized OSNs may suffer of other problems, like limited scalability and high maintenance costs to manage data of large number of users [2].

With the advancement of digital platforms, online shopping environments are evolving as well, and they are able to offer consumers more options in the purchase process, providing them with better services and products. Indeed, personalization strategies can be used to influence consumers’ behaviour and increase their loyalty both offline (Melewar et al., 2017) and online (Ho and Bodoff, 2014; Pappas et al., 2016), while at the same time they may indicate a company’s commitment to offer value to its customers (Adobe, 2015). By 2020, four billion people are expected to be online, suggesting that addressing customers’ needs will be more important than ever (IDC, 2015) while developing new or improved business strategies and models. Personalization can change consumers’ behaviour, and reduce acquisition costs, while increasing revenues, and marketing efficiency (Ariker et al., 2015). However, marketing practice requires further advancement, as it is not at the same level as current technical capabilities (Adobe, 2015). Cognitive and affective factors (Ho and Bodoff, 2014; Pappas et al., 2017b), trust and privacy (Lee and Rha, 2016) and experience (Pappas et al., 2014b) may affect consumers’ attitudes and evaluations in online shopping. As marketers use interactive technologies to modify consumers’ behaviour (Kaptein and Eckles, 2012), they develop strategies that build on logical arguments, make emotional appeals or request input or feedback from and for them (Pappas et al., 2017b). Recent studies in personalization have identified the critical role of trust towards the online vendor, privacy and emotions (Bleier and Eisenbeiss, 2015; Pappas et al., 2016). When using personalized services or receiving customized recommendations, the personalization–privacy paradox may occur (Baek, 2014; Xu et al., 2011), based on which consumers have to make a choice between personalization benefits and privacy risks. In such cases, recent studies show that trust, emotions and previous purchase experience (Lee and Rha, 2016; Pappas et al., 2017b) are sometimes key factors that can influence consumers’ behavioural intentions. Although trust is a multidimensional construct, here, unless otherwise mentioned, we take the point of view of the consumer, thus “trust” refers to consumers’ trust perceptions towards the online vendor when using personalized online services and refers to continuing trust rather than initial trust (Gefen et al., 2003). Also, emotions are defined as how happy, anxious, sad or angry consumers feel (Ekman, 1992a, 1992b), which are considered among the basic emotions, clearly distinguished from each other, and have been found to be effective in explaining how people perform and behave with computers (Kay and Loverock, 2008). Therefore, as these factors are critical for successful personalized online shopping and they may interact with each other in multiple ways, they may be studied together to better assess their effects on customers’ purchase intentions

Popular Online Social Networks (OSNs), such as Facebook, Twitter, or LinkedIn, are logically centralized services, that are owned and managed by single business entities. It is no secret to any one that their business, although presented as a free-service provision model, is fueled by targeted and retargeted marketing [2]. These are two marketing strategies that stand on data collection and on learning as much as possible about potential customers, their tastes, their habits, their spending patterns, or even their feelings and states of mind. Based on such information, potential customers can be smartly targeted, or retargeted by presenting the right product to the right person at ideally the right time, making advertisement more profitable. Most of these popular OSN companies count over hundreds of millions of registered users that enjoy their services, and occupy considerable portions of their computing and storage resources without direct subscriptions or monetary service fees. Therefore, they have a vital interest in collecting as much data as possible about their “free” subscribers, and in learning all what could possibly be extracted from this collected data. This collected data does not only cover the information that OSN users willingly upload and share with their contacts, but encompasses it to implicitly disclosed information, such as the times when users are online, the locations from where they connect, the type of activities they perform based on different locations and times, etc. This unprecedented massive and uncontrolled collection and aggregation of different types of data about millions of individuals, from across all areas of the globe, in the hands of a few centralized entities is considered as one of the most serious and fundamental threats to users right to-be-left-alone; that is to their right to privacy.1 This has been even more accentuated with the detected incidents of data leakage, either accidentally, due to attacks exploiting security breaches in those systems,2 or intentionally to interested third parties such as secret services, or other interested companies. This makes some advocates spell out the fact that OSN users are not customers but rather the primary commercialized product under the business model of current centralized OSN providers.3 One of the most systematic and straightforward responses to mitigate this privacy dilemma of logically centralized services is to move to decentralized architectures. This idea has given birth to research under the area of what has been known as Decentralized Online Social Networks (DOSNs), where the fundamental motivation is to mitigate privacy issues that are inherrent to the centralized model by desiging solutions that can provide similar online socializing functionality without the need of any one single central trusted entity [3]. Achieving this has been considered under two main conceptions. The first one consists at an architecture of multiple independent federated servers that provide the same OSN functionality, from which users can freely choose which to join and whom to trust, and between which users can freely and seamlessly switch without losing any of their advantages or functionality (e.g., [5–7]). The second conception takes decentralization to its extremes and consists at building peer-to-peer (P2P) networks of end users devices, with direct one-to-one interactions between them (e.g., [8–10]).

Since the leaks of the National Security Agency global surveillance by Edward Snowden [1], privacy in online activity has been one of the rising concerns for Internet users [2]. While these concerns date back nearly two decades [3] and have not led to wide use of privacy-enhancing technologies [4], the topic of privacy rights in online activity is higher than ever on political agenda and media attention. Sharing private information can be motivated by services or information received in exchange, for example in the case of sharing health information with a doctor. Nevertheless, this does not need to be the case in online social networks: A 2016 Pew Research Center survey [5] showed that more than 51% of respondents consider it not acceptable to share private information with an online social network that shows personalized advertisement, in fear of third parties accessing such private data. Social networking sites do not exist in isolation in cyberspace, they exist in the Platform Society [6] and can integrate information from other sites and applications. For several years, more than a billion users of the Facebook mobile applications [7] have given permissions to Facebook to read their phone contact lists.a This motivated the protest of the Europe-vs-Facebook advocacy group about Facebook building shadow profiles [8, 9]: hidden files on individuals with private information that has been inferred through the individual’s friends inside the social network. These shadow profiles can potentially be built for non-users without an account in the social networking site and that did not agree to its privacy policy [10]. The possibility to build shadow profiles would pose an important concern with respect to privacy rights and informational self-determination [11]. Previous research has extensively evaluated privacy risks for users of social media, in general by evaluating the inference of personal attributes of users from their digital traces [12]. For example, Twitter data can be used to predict user locations [13, 14] as well as gender, age, and political orientation of users [15]. Publicly available information in locationbased social networks, such as Foursquare, can also be used to predict the home location of users [16]. Facebook has also been shown to be extremely informative of user personal information, including sexual orientation [17], romantic partnerships [18], and a wealth of other private attributes that can be inferred from user “likes” [19, 20].

Although Internet users can enjoy improved online services with the daily use of information communication technology (ICT), they may face threats associated with personal information misuse (Bansal & Gefen, 2010). For example, while mobile coupons based on users’ location information can provide highly personalized services, they may induce strong feelings of privacy intrusiveness (Sutanto, Palme, Tan, & Phang, 2013). Because digitized personal information can be easily stored, duplicated, conveyed, and integrated in online environments, risks to information privacy have become more significant in the digital age (Junglas, Johnson, & Spitzmüller, 2008). In spite of ongoing efforts to protect users’ privacy rights, data breach incidents have continued (Sen & Borle, 2015). 4,149 data breaches were reported in 2016, affecting over 4.2 billon records.1 500 million Yahoo user accounts were compromised in 2014, after a breach involving more than 1 billon user accounts in 2013.2 The frequent data breaches remind people that they are not in control of their online information. Privacy fatigue reflects a sense of weariness toward privacy issues, in which individuals believe that there is no effective means of managing their personal information on the Internet (Acquisti, Friedman, & Telang, 2006; Hargittai & Marwick, 2016). Prior research has shown that over-disclosure of personal information is commonplace among Internet users (Preibusch, Krol, & Beresford, 2013). Because there is good evidence that fatigued individuals are likely to reduce their decision making efforts (Levav, Heitmann, Herrmann, & Iyengar, 2010), such behavior can be considered as a manifestation of privacy fatigue among the users who are not willing to devote major efforts to managing the information to they share. Recognizing the gravity of information privacy threats, researchers have intensively investigated users’ privacy behaviors. Considerable emphasis has been placed on an individual’s subjective assessment of information privacy risk, referred to as online privacy concern (hereafter, “privacy concern”). Prior studies have demonstrated that privacy concern is an important antecedent of the adoption of ICT services (Dinev & Hart, 2006). Privacy concern, however, does not account for the range of users’ responses to privacy risk. For example, although repeated data breaches may increase privacy concern, the public is inclined to underestimate or ignore the risk (Ponemon, 2014). Frequent data breaches may make people feel as though they have no control over personal information, and ultimately drive them into a state of resignation about online privacy (Kwon & Johnson, 2015).