An analytical study
for sensor service providers
to keep their user's security
Oct. 2012

T a k a m i c h i

A s o uInstituteSecurityofInformation

1

Contents
1. Intro
2. Sensor Service
3. My motivation of research
4. I am worried about privacy violation
5. What is sensor data?
6. Protect privacy
7. Scenarios to use cloud effectively
8. Scenarios and Security requirements
9. Methods x Scenarios
10.Outro2

2. Sensor services
Purpose of the set

Kind of sensor【power train control】

Traffic,Vehicle

・Control of vehicle
・Maintain vehicle
・Navigation system
・JAM prediction
・Avoid car accident

Throttle position, Accelerator , Intake pressure, Fuel pressure,…

【Vehicle Control】
laser radar, Steering, Throttle, Acceleration, …
【Body control】
Back sonar, Corner sonar, …
【Communication】
laser radar, GPS, VICS, Gyro, …

Mobile・Performance improvement
・Utility value improvement

GPS, Gyro, Thermometer, Acceleration,Barometer, Illuminometer. …

Smart
House

・HEMS
・Appliances control

Smart meter
Gus, water, Motion, Door, Camera …

http://e-public.nttdata.co.jp/topics_detail2/id=659
http://www.denso.co.jp/ja/aboutdenso/technology/dtr/v11_1/files/disseration14itp6.pdf
http://www.sei.co.jp/products/info/its_jp.pdf
http://easy.mri.co.jp/20120228.html
http://www.jipdec.or.jp/dupc/forum/eships/results/doc/h21project_report1-1.pdf

6

2. Sensor services
SensorOwner

Traffic,Vehicle Owner
VehicleMobile Mobile Owner

SmartHousePower Companyor
Sensor Owner

Who set the sensor？
？

Auto Manufacturer

Mobile Maker
CareerPower Companyor
Sensor Owner

Who collect the data? Who want to use the data?
Who is the target to sense?
(Sensor service provider) (Other Service Provider)
Auto Manufacturer（government））

Government

Auto Manufacturer

Insurance

Auto Manufacturer

Auto Manufacturer

Auto Manufacturer

Owner, owner’s Family

Application Provider

End User

Career

Career

CareerGovernment

Power Company

Power Company

Government

Government

CareerSensor Owner

Vehicle User(family, friends..)

Mobile User

Family(not individual)

・The target is not only the owner・Someone who utilize sensor data is not only the owner of sensor, target
Sensor service provider recognize this complicated situation.

7

3. My motivation of research8

3. My motivation of research
As a sensor service provider

Because data volume is increasing, I want to use cloud securely at low cost,and I want the data to be used for secondary use for next business.
End user(I)
Sensor service provider

Cloud provider(3rd party)

Other service provider

・low cost・agility・scalability
Data

Secondary use
sensorSensor data

Data
Statisticaldata

ServiceSensor data

There might be some concerns to use cloud…

9

4. I am worried about privacy violation■Most important concern is data leakage when I use cloud
I am worried about two types of patterns.
Pattern 1 : External attacker attacks cloudPattern 2 : Internal attacker attacks cloudEnd userSensor service provider

Assume that this would
absolutely happen.
I want my customer
not to be violated their privacy.
Cloud provider

Other service provider

Pattern 2

sensorSensor dataarchives
Sensor data
Sensor data

Statisticaldata

Pattern 1105. What is sensor data?
■Sensor data is divided into two kinds.

1. Personal information
2. Sensitive data (information)
1. Personal Information
・Customer Information
We have to protect this kind of information and follow theJapanese law named“Act concerning protection of Personal Information”
Especially, article 19 ~ 23
http://www.japaneselawtranslation.go.jp/law/detail_main?id=130&vm=4&re=This law and my assumption,
I have to decide very carefully whether I use cloud for it or not.
11

5. What is sensor data?
2. Sensitive data

http://articles.chicagotribune.com/2012-09-27/news/ct-tl-naperville-smart-meter-arguments-20120927_1_naperville-smart-meterawareness-analog-meters-security-and-privacy-concerns

・physical data, religion, race, medical record, …
・Sensor data (electric, gas, water) This kind of data could show privacy

But this data needs a fixed term. Not just one, single data

must prevent
invasion ofend users privacy

12
http://spectrum.ieee.org/energy/the-smarter-grid/privacy-on-the-smart-grid6. Protect privacy
What is the meaning to protect end user’s privacy
from leaking of their sensitive data?
・prevention the identifying individual
・prevention the invasion of privacy●Anonymity
k-anonymity
l-diversity

CustomerID

ProductIDTime to send

ABCD1234

ID00001

2012/7/1 10:10:01:21

2012/7/1 10:00:00

3

ABCD9876

ID00002

2012/7/1 10:10:03:08

2012/7/1 9:58:57

7●Reconstruction (perturbation)
Randomization
Swapping
perturbation that converts attributes probabilisticallyreconstruction that derives a statistic from a perturbed data

Secure multiparty computation
Functional Encryption

How can I ?

homomorphic encryption
Shamir’s Secret Sharing

Time to be measured

Volume(mA)

Depend on
how to use Cloud &use for what13

7. Scenarios to use cloud effectively
End user(I)Sensor service provider

Cloud provider

Other service provider・low cost・agility
・scalability
ScenarioBsensorDataarchives
Dataarchives

Sensor data

Secondary use
Statisticaldata

Sensor data

Service

ScenarioA

Scenario
CIn the case,Sensor service provider has notified the end users thatmodified sensor data, which is of course eliminated identifying individual and sensitive factors, such as statistical data,
14
would be used for secondary use with specific other service providers.

8. Scenarios and Security requirements
Sensor service
providerEnd user

S1
ScenarioA

Cloud provider
Primary Service

Ea(S1)

Ea

Safe Databy encryption
Ea(S1), Ea(S2)

S1
Ea(S1)

Other service
providerS1
Scenario
BEb

S1

Eb(S1)

Sensor data
Sb1,Sb2, ..

S1
ScenarioC

Safe Databy anonymization
reconstruction
Eb(S1), Eb(S2)

Eb(S1)

Ec(S1)
Ec(S1)

S1

Secondary use
without decryption

Safe Databy my dream
Ec(S1), Ec(S2)Ec

Secondary use
without decryption

Ec(S1)

15

9. Methods x Scenarios■Table: Method x Scenarios

Anonymization

Reconstruction

Encryption

Scenario
A--○Scenario
B○

○

-

Scenario
C---○ satisfy my security requirements- hardly satisfy my security requirements●On Scenario C,
you are hardly able to use anonymization, Reconstruction.
because both wouldn’t end up with getting out row data of.

16

10. outro

17

Fin.

18

19

k-anonymity
Definition 3. k-anonymity
Let RT(A1,...,An) be a table and QIRT be the quasi-identifier associated with it.
RT is said to satisfy k-anonymity if and only if each sequence of values inRT[QIRT] appears with at least k occurrences in RT[QIRT].

L. Sweeney. k-anonymity: a model for protecting privacy. International Journal on Uncertainty,
Fuzziness and Knowledge-based Systems, 10 (5), 2002; 557-570.

20

Reconstruction method

StudentScore

ARandomize

Student

Score

85

A

2

B

68

B

68

C

72

C

92・・・

You don’t know
These score are true or not.
These were reset forNONSENSE VALUE・・・
It’s useful for statistical.

Number ofstudents

Reconstruction

score

Return to almost the same distribution.

 中道 理，河合 基伸，“特集 センサ・データを解放せよ ユーザを”不幸“にしないための処方箋，”日経エレクトロニクス，no.1083，5-28，
21pp.25-50，May.2012 をベースに作成