# Privacy and Identity Management

Michael Friedewald, Stefan Schiffner, Stephan Krenn

► To cite this version:

Michael Friedewald, Stefan Schiffner, Stephan Krenn. Privacy and Identity Management: 15th IFIP WG 9.2, 9.6/11.7, 11.6/SIG 9.2.2 International Summer School, Maribor, Slovenia, September 21–23, 2020, Revised Selected Papers. Springer International Publishing, AICT-619, 2021, IFIP Advances in Information and Communication Technology, 978-3-030-72464-1. 10.1007/978-3-030-72465-8. hal-03703756

HAL Id: hal-03703756

https://inria.hal.science/hal-03703756

Submitted on 24 Jun 2022

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Editor-in-Chief

Kai Rannenberg, Goethe University Frankfurt, Germany

Editorial Board Members

TC 1 – Foundations of Computer Science
Luís Soares Barbosa①, University of Minho, Braga, Portugal

TC 2 – Software: Theory and Practice
Michael Goedicke, University of Duisburg-Essen, Germany

TC 3 – Education
Arthur Tatnall①, Victoria University, Melbourne, Australia

TC 5 – Information Technology Applications
Erich J. Neuhold, University of Vienna, Austria

TC 6 – Communication Systems
Burkhard Stiller, University of Zurich, Zürich, Switzerland

TC 7 – System Modeling and Optimization
Fredi Tröltzsch, TU Berlin, Germany

TC 8 – Information Systems
Jan Pries-Heje, Roskilde University, Denmark

TC 9 – ICT and Society
David Kreps①, National University of Ireland, Galway, Galway, Ireland

TC 10 – Computer Systems Technology
Ricardo Reis①, Federal University of Rio Grande do Sul, Porto Alegre, Brazil

TC 11 – Security and Privacy Protection in Information Processing Systems
Steven Furnell①, Plymouth University, UK

TC 12 – Artificial Intelligence
Eunika Mercier-Laurent①, University of Reims Champagne-Ardenne, Reims, France

TC 13 – Human-Computer Interaction
Marco Winckler①, University of Nice Sophia Antipolis, France

TC 14 – Entertainment Computing
Rainer Malaka, University of Bremen, Germany
# IFIP – The International Federation for Information Processing

IFIP was founded in 1960 under the auspices of UNESCO, following the first World Computer Congress held in Paris the previous year. A federation for societies working in information processing, IFIP's aim is two-fold: to support information processing in the countries of its members and to encourage technology transfer to developing nations. As its mission statement clearly states:

> IFIP is the global non-profit federation of societies of ICT professionals that aims at achieving a worldwide professional and socially responsible development and application of information and communication technologies.

IFIP is a non-profit-making organization, run almost solely by 2500 volunteers. It operates through a number of technical committees and working groups, which organize events and publications. IFIP's events range from large international open conferences to working conferences and local seminars.

The flagship event is the IFIP World Computer Congress, at which both invited and contributed papers are presented. Contributed papers are rigorously refereed and the rejection rate is high.

As with the Congress, participation in the open conferences is open to all and papers may be invited or submitted. Again, submitted papers are stringently refereed.

The working conferences are structured differently. They are usually run by a working group and attendance is generally smaller and occasionally by invitation only. Their purpose is to create an atmosphere conducive to innovation and development. Refereeing is also rigorous and papers are subjected to extensive group discussion.

Publications arising from IFIP events vary. The papers presented at the IFIP World Computer Congress and at open conferences are published as conference proceedings, while the results of the working conferences are often published as collections of selected and edited papers.

IFIP distinguishes three types of institutional membership: Country Representative Members, Members at Large, and Associate Members. The type of organization that can apply for membership is a wide variety and includes national or international societies of individual computer scientists/ICT professionals, associations or federations of such societies, government institutions/government related organizations, national or international research institutes or consortia, universities, academies of sciences, companies, national or international associations or federations of companies.

More information about this series at http://www.springer.com/series/6102
Michael Friedewald · Stefan Schiffner ·
Stephan Krenn (Eds.)

Privacy and Identity
Management

15th IFIP WG 9.2, 9.6/11.7, 11.6/SIG 9.2.2

International Summer School

Maribor, Slovenia, September 21–23, 2020

Revised Selected Papers

<figure><img src="image_2.png" /></figure>

Springer
Editors

Michael Friedewald
Fraunhofer Institute for Systems
and Innovation Research ISI
Karlsruhe, Germany

Stefan Schiffner
Université du Luxembourg
Esch-sur-Alzette, Luxembourg

Stephan Krenn
AIT Austrian Institute of Technology
Vienna, Austria

ISSN 1868-4238
ISSN 1868-422X (electronic)
IFIP Advances in Information and Communication Technology
ISBN 978-3-030-72464-1
ISBN 978-3-030-72465-8 (eBook)

https://doi.org/10.1007/978-3-030-72465-8

© IFIP International Federation for Information Processing 2021

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Preface

This volume contains the proceedings of the 15th IFIP Summer School on Privacy and Identity Management, which took place during September 21–23, 2020. Originally planned to be held in Brno, Czech Republic, the summer school had to be moved to Maribor, Slovenia, and was finally held as a fully virtual event, due to the COVID-19 pandemic. The summer school was co-located with IFIP Sec 2020 and WISE 13.

The 15th IFIP Summer School was a joint effort among IFIP Working Groups 9.2, 9.6/11.7, 11.6, and Special Interest Group 9.2.2, in co-operation with the European Union's cybersecurity competence network pilot projects CyberSec4Europe<fnref n="1" />, SPARTA<fnref n="2" /> and CONCORDIA<fnref n="3" />.

This IFIP Summer School brought together more than 40 junior and senior researchers and practitioners from different parts of the world from many disciplines, including many young entrants to the field. They met to share their ideas, build a network, gain experience in presenting their research, and have the opportunity to publish a paper through these proceedings.

As in previous years, one of the goals of the IFIP Summer School was to encourage the publication of thorough research papers by students and emerging scholars. To this end, it had a three-phase review process for submitted papers. In the first phase, authors were invited to submit short abstracts of their work. Abstracts within the scope of the call were selected for presentation at the school. After the school, authors were encouraged to submit full papers of their work and receive two to three reviews by members of the Program Committee. They were then given time to revise and resubmit their papers for inclusion in these proceedings.

In total, 21 abstracts were submitted, out of which 17 were presented at the virtual conference, and 13 were finally accepted for publication. In addition, Marit Hansen (State Data Protection Commissioner of Land Schleswig-Holstein, Germany) gave a keynote lecture on “Privacy-Enhancing Technologies—where are we after 25 years?”, and Sandra Schmitz and Stefan Schiffner (University of Luxembourg) gave a tutorial entitled “Don’t Put the Cart Before the Horse – Effective Incident Handling Under GDPR and NIS Directive”. A summary of the latter is also included in this volume.

We are grateful to all contributors of the summer school and especially to the Program Committee for reviewing the abstracts and papers as well as advising the

<footnote n="1">¹ https://www.cybersec4europe.eu/.</footnote>

<footnote n="2">² https://www.sparta.eu/.</footnote>

<footnote n="3">³ https://www.concordia-h2020.eu/.</footnote>
authors on their revisions. Our thanks also go to all supporting projects, the organizers
of IFIP Sec, the Steering Committee for their guidance and support, and all participants
and presenters.

January 2021

Michael Friedewald

Stefan Schiffner

Stephan Krenn
# Organization

## General Chair

Stephan Krenn

AIT Austrian Institute of Technology, Austria

## Program Chairs

Michael Friedewald

Fraunhofer ISI, Germany

Stefan Schiffner

University of Luxembourg, Luxembourg

## Organizing Committee

Gloria González Fuster

Vrije Universiteit Brussel, Belgium

Váshek Matyáš

Masaryk University, Czech Republic

## Program Committee

Florian Adamsky

University of Applied Sciences Hof, Germany

Daniel Bachlechner

Fraunhofer Austria, Austria

Felix Bieker

Independent Centre for Privacy Protection
Schleswig-Holstein, Germany

Mauro Brignoli

Vitrociset S.p.A., Italy

Sonja Buchegger

KTH Royal Institute of Technology, Sweden

Sébastien Canard

Orange Labs, France

Pavel Čeleda

Masaryk University, Czech Republic

Josep Domingo-Ferrer

Universitat Rovira i Virgili, Spain

Orhan Ermiş

Eurecom, France

Simone Fischer-Hübner

Karlstad University, Sweden

Pedro Freitas

University of Minho, Portugal

Michael Friedewald

Fraunhofer ISI, Germany

Lothar Fritsch

Karlstad University, Sweden

Gloria González Fuster

Vrije Universiteit Brussel, Belgium

Jan Hajný

Brno University of Technology, Czech Republic

Dominik Herrmann

University of Bamberg, Germany

Meiko Jensen

Kiel University of Applied Sciences, Germany

Stefan Katzenbeisser

University of Passau, Germany

Kai Kimppa

University of Turku, Finland

Stephan Krenn

AIT Austrian Institute of Technology, Austria

Eva Lievens

Ghent University, Belgium

Lukáš Malina

Brno University of Technology, Czech Republic

Ninja Marnau

CISPA Helmholtz Center for Information Security,
Germany
<table><tr><td>Váshek Matyáš</td><td>Masaryk University, Czech Republic</td></tr><tr><td>Joachim Meyer</td><td>Tel Aviv University, Israel</td></tr><tr><td>Andreas Nautsch</td><td>Eurecom, France</td></tr><tr><td>Sebastian Pape</td><td>Goethe University Frankfurt, Germany</td></tr><tr><td>Aljosa Pasic</td><td>Atos Research & Innovation, Spain</td></tr><tr><td>Robin Pierce</td><td>Tilburg University, The Netherlands</td></tr><tr><td>Jo Pierson</td><td>Vrije Universiteit Brussel, Belgium</td></tr><tr><td>Tobias Pulls</td><td>Karlstad University, Sweden</td></tr><tr><td>Kjetil Rommetveit</td><td>University of Bergen, Norway</td></tr><tr><td>Arnold Roosendaal</td><td>The Privacy Company, The Netherlands</td></tr><tr><td>Ina Schiering</td><td>Ostfalia University of Applied Sciences, Germany</td></tr><tr><td>Stefan Schiffner</td><td>University of Luxembourg, Luxembourg</td></tr><tr><td>Valerie Verdoodt</td><td>London School of Economics, UK</td></tr><tr><td>Diane Whitehouse</td><td>The Castlegate Consultancy, UK</td></tr><tr><td>Marc van Lieshout</td><td>Radboud University, The Netherlands</td></tr><tr><td>Simone van der Hof</td><td>Leiden University, The Netherlands</td></tr><tr><td>Rose-Mharie Åhlfeldt</td><td>University of Skövde, Sweden</td></tr><tr><td>Melek Önen</td><td>Eurecom, France</td></tr></table>

Additional Reviewers

<table><tr><td>Tsany Ratna Dewi</td><td>University of Luxembourg, Luxembourg</td></tr><tr><td>Dara Hallinan</td><td>Leibniz Institute for Information Infrastructure, Germany</td></tr><tr><td>Amirhossein Adavoudi<br>Jolfaei</td><td>University of Luxembourg, Luxembourg</td></tr><tr><td>Thomas Lorünser</td><td>AIT Austrian Institute of Technology, Austria</td></tr><tr><td>Ana Pop Stefanija</td><td>Vrije Universiteit Brussel, Belgium</td></tr><tr><td>Sandra Schmitz-Berndt</td><td>University of Luxembourg, Luxembourg</td></tr></table>
# Contents

## Tutorial Paper

<table><tr><td>Don't Put the Cart Before the Horse – Effective Incident Handling Under GDPR and NIS Directive</td><td>3</td></tr><tr><td>Sandra Schmitz-Berndt and Stefan Schiffner</td><td></td></tr></table>

## Selected Student Papers

<table><tr><td>Ethical Principles for Designing Responsible Offensive Cyber Security Training</td><td>21</td></tr><tr><td>Fredrik Heiding and Robert Lagerström</td><td></td></tr></table>

<table><tr><td>Longitudinal Collection and Analysis of Mobile Phone Data with Local Differential Privacy</td><td>40</td></tr><tr><td>Héber H. Arcolezi, Jean-François Couchot, Bechara Al Bouna, and Xiaokui Xiao</td><td></td></tr></table>

<table><tr><td>Privacy-Preserving IDS for In-Vehicle Networks with Local Differential Privacy</td><td>58</td></tr><tr><td>Peter Franke, Michael Kreutzer, and Hervais Simo</td><td></td></tr></table>

<table><tr><td>Strong Customer Authentication in Online Payments Under GDPR and PSD2: A Case of Cumulative Application</td><td>78</td></tr><tr><td>Danaja Fabcic</td><td></td></tr></table>

<table><tr><td>Privacy in Payment in the Age of Central Bank Digital Currency</td><td>96</td></tr><tr><td>Frédéric Tronnier</td><td></td></tr></table>

<table><tr><td>Analysing Drivers' Preferences for Privacy Enhancing Car-to-Car Communication Systems: A Study from South-Africa</td><td>115</td></tr><tr><td>Lejla Islami, Simone Fischer-Hübner, Eunice Naa Korkoi Hammond, and Jan Eloff</td><td></td></tr></table>

<table><tr><td>Learning Analytics and Privacy—Respecting Privacy in Digital Learning Scenarios</td><td>134</td></tr><tr><td>Marvin Priedigkeit, Andreas Weich, and Ina Schiering</td><td></td></tr></table>

<table><tr><td>Preserving Privacy in Caller ID Applications</td><td>151</td></tr><tr><td>Tamara Stefanović and Silvia Ghilezan</td><td></td></tr></table>
<table><tr><td>"Identity Management by Design" with a Technical Mediator Under the GDPR</td><td>169</td></tr><tr><td>Anne Steinbrück</td><td></td></tr><tr><td>Open About the Open-Rate? State of Email Tracking in Marketing Emails and Its Effects on User's Privacy</td><td>187</td></tr><tr><td>Shirin Kalantari</td><td></td></tr><tr><td>Privacy Respecting Data Sharing and Communication in mHealth: A Case Study</td><td>206</td></tr><tr><td>Michael Pleger and Ina Schiering</td><td></td></tr><tr><td>Privacy-Preserving Analytics for Data Markets Using MPC</td><td>226</td></tr><tr><td>Karl Koch, Stephan Krenn, Donato Pellegrino, and Sebastian Ramacher</td><td></td></tr><tr><td>Towards Models for Privacy Preservation in the Face of Metadata Exploitation</td><td>247</td></tr><tr><td>Marine Eviette and Andrew Simpson</td><td></td></tr><tr><td>Author Index</td><td>265</td></tr></table>