# Privacy-Preserving Sports Wearable Data Fusion Framework

Authors: Jia Li; Jie Zhang
Journal: Computational Intelligence and Neuroscience
 (2022)

---

## Abstract

When the sports industry has access to advanced training and preparation techniques, the sports sector is entering a new era, where real-time data processing services have a crucial priority in improving physical fitness and avoiding injuries to athletes. The primary sports support methodology is based on multiple sensors, mainly wearables, often of different types and technology, which collect somatometric data in real time and are usually analyzed with deep learning technologies. And while modern athletes train and prepare intelligently using the innovative techniques of available technology, there is considerable concern about the use of personal data. There is great concern about cyberattacks and possible data leaks that could affect the sports industry and sports in general. To secure the personal data of athletes collected and analyzed by sports wearables, this paper presents a privacy-preserving sports wearable data fusion framework. This is an advanced methodology based on Lagrange's relaxation method for the problem of multiple assignments and synthesis of information by numerous sensors and the use of differential privacy to access databases with personal information, ensuring that this information will remain personal without a third entity may disclose the identity of the athlete who provided the data.


---

## Body

## 1. Introduction

To overcome the competition, the modern athlete must train and prepare intelligently and take advantage of innovative techniques. Its training program must be fully personalized, incorporating advanced tools of particular precision and functionality, based on the latest scientific innovations, advanced training systems, multidisciplinary medical positions, sports researchers, and people working in advanced sports [1]. The implementation of such a program includes unique tools for monitoring the athlete's health, ergonomic characteristics, and ways to manage training load and avoid injuries [2, 3].A key innovation used by the entire sports industry is the athlete's involvement in capturing valuable information daily [4]. The time that the athlete must devote is usually identified with the hours of his daily training, and the data recorded is generally divided into three main categories [5].(1)
Wellness: The athlete's well-being is recorded daily based on his answer to seven critical questions.(2)
Training load: At the end of each training unit, the athlete registers the subjective sense of effort, which leads to valuable conclusions compared to the training load designed by the coach. With these data, documented indicators are calculated, such as the weekly load change, the ratio of current and chronic load, and the monotonicity index, to capture whether the athlete is in the ideal training zone, in a subtraining zone, or has entered a zone with a high risk of injury. For example, when the current and chronic load ratio is high (>1.5), the risk of injury increases, and the training load must be corrected. Also, the weekly increase in load is an essential indicator for injury prevention. A 15% increase in load compared to the previous week causes a 50% increase in the probability of injury.(3)
Health: The athlete can record extraordinary changes in his health due to illness or injury. In the purely training field, the coach undertakes the detailed planning of the training, which can be individualized and adapted, by category, for athletes who are rested, injured, absent, etc. All kinds of evaluations are collected and recorded from tests such as blood, platelets, fasting glucose, iron, creatinine, total cholesterol, up to weekly vertical jump markers, maximal oxygen uptake, but also special tests such as substance abuse control, amphetamines, cocaine, cannabinoids, barbiturates, opioids (heroin, codeine, morphine), ethanol (alcohol), benzodiazepines, and evaluation of an acceptable or nonacceptable creatinine sample.Because it is information on an identified or identifiable physical person, all of the above information constitutes personal data. It is subject to the status of personal data legislation (“data subject”) [6]. An identifiable physical person is one whose identity can be determined, directly or indirectly, through the use of an identifier such as a name, identity number, location data, online identifier, or one or more identifiable factors such as that physical person's physical, physiological, genetic, psychological, economic, cultural, or social identity [7].Data fusion [8] of personal data from multiple sensors for the rational use of various information is a highly complex research problem without identifying an effective solution for the functional and practical expansion of advanced personal data usage applications [9]. This view is particularly noticeable because the nature of these applications is constantly changing towards more centralized and demanding applications, where the management of incoming information is not as apparent as it was in the usually single-sensory systems of the first generation of data acquisition and management applications [10, 11]. These applications are also evolving and growing in number, incorporating increasingly sensitive information, which requires more advanced security techniques [12, 13]. All of the above introduce different types and topologies of sensors, increasing the need for a common and effective intermediate level of security between sensors and applications [14, 15].Data mining privacy preservation entails concealing output knowledge of data through various approaches when the output data are valuable and private. This is mainly accomplished by employing two techniques: input privacy, in which information is changed using multiple styles, and output privacy, in which data are transformed to conceal the rules. Privacy preservation is critical in data mining because when data are moved or communicated between different parties, it is required to offer security to that data so that other parties do not know what information is displayed between the original parties.Managing this coming from multiple sources different from each other complementary or surplus personal information has been recognized as a significant and critical factor in the development of sport and, in general, in preserving the prestige and credibility of the sports industry. The intermediate level of security between sensors and applications is the position occupied by the proposed privacy-preserving sports wearable data fusion framework [16, 17]. The proposed methodology ensures the integrity of the data synthesis from heterogeneous sources while guaranteeing the anonymity and reliability of the data even in cases of the use of the data in question by third-party analysts.


## 2. Related Literature

Because of the expansion of wearable devices and the fact that they manage personal data [14, 18], the research community focuses on privacy-preserving frameworks, as seen in the literature shown below.Banerjee et al. [16] investigated the appropriateness of the Health Insurance Portability, and Accountability Act (HIPAA) concerns created by wearable technology in the IoT ecosystem, identifying legislative gaps and variables that promote health data exposure. They developed a partnership-identity risk model, showed the ramifications in four distinct settings, and offered privacy protection advice. They classified industrial self-regulation from “pure” self-regulation to “mixed” self-regulation. There is no government involvement or any other stakeholder in the private regulating mechanism, public standard setting, pricing, or output setting. There is a high level of close federal monitoring. They noted that many of the issues with health data sharing would be addressed by the business itself. However, a hybrid of industry rule-making and government monitoring has the most potential for industry self-regulation.Zarepour et al. [19] proposed a privacy-aware architecture for wearable cameras that might safeguard all sensitive topics such as persons, objects, and places. It identifies the likely sensitive issues in each picture using contextual information acquired from the wearable sensors and stored photos. Various techniques are used to identify sensitive items after detecting the surroundings and the user's behavior. The sensitive items are first placed and then obscured or erased using image editing methods. Their findings indicated that the suggested system could identify and blur sensitive objects with sufficient precision in both an interior and an outside setting.In 2014, Safavi et al. [20] proposed a theoretical model for wearable medical systems, which included ten concepts and nine tests capable of delivering a comprehensive privacy protection bundle to wearable device users, and which could be implemented on any wearable OS. They built this framework by examining current mobile technology, which was then coupled with current security norms and assessed using strict information security principles. They have also recommended a detailed checklist that might aid both designers and manufacturers improve the quality of their products' privacy measures. Finally, they acknowledged that these frameworks would be impossible to execute without law compliance that integrates security and confidentiality with regulation.Chen et al. [21] introduced FedHealth, a distributed transition knowledge architecture for wearable healthcare, to address the difficulties of user data being stored in isolated islands and cloud-based models failing to personalize. FedHealth is a broad and extendable system that conducts data aggregation using federated learning and then creates reasonably tailored models using transfer learning in various healthcare applications. Their tests and applications have shown that accurate and individualized healthcare may be provided without jeopardizing privacy and security. They want to expand this technique with incremental learning in the future to provide more tailored and adaptable treatment.Psychoula et al. [17] examined privacy resilience and methods for preserving and integrating privacy into present frameworks. As customers grow more conscious of privacy threats and demand greater privacy control from service providers, the privacy environment will evolve. Frameworks that include privacy risks might affect how data are kept, processed, and shared. They argue that data collection, management, and sharing will become even more fragmented, with each service provider having to subscribe to a user's info instead of the other side around. As a result, addressing the privacy protection dilemma requires focusing on privacy knowledge and risk. Methods for understanding and learning user preferences and negotiating to satisfy their expectations should be researched. Finally, developing algorithmic privacy risk indicators can reliably determine a person's privacy risk based on data acquired and provided about the user.Finally, Poore et al. [22] introduced the Lagrangian relaxation method that we use, stating that these techniques have proven to be particularly helpful in solving these issues to the interference level in real time, particularly for dense scenarios and numerous scans of data from various sensors. Their research introduced a new family of creative Lagrangian relaxation methods that address some of the shortcomings of prior approaches. The efficiency and efficacy of their technique class are shown by various numerical investigations.From the above literature, we can say that privacy-preserving [23] frameworks are under the research community's focus because of the explosion of these devices and the fact that they handle personal data [16].


## 3. Methodology

Data merging occurs when data from many sources are merged to reflect a single reference point. Although it appears to be a simple goal, data merging is a complex procedure because most databases suffer from redundancy, inconsistency, and inaccuracy. To derive significant insights from the data obtained, it is necessary to consolidate all of these data sources and get a single point of reference. The requirement for database compliance with data privacy legislation had far-reaching consequences for database management methods. However, various obstacles must be overcome to ensure database compliance with data privacy rules.Differential privacy is a technique for publicly disclosing information about a dataset by defining the patterns of groups within the dataset while maintaining the privacy of individuals. The assumption behind differential privacy is that if the effect of a single arbitrary database modification is small enough, the query result cannot be used to infer much about any one individual, hence ensuring privacy. Differential privacy can also be defined as a constraint placed on the algorithms used to publish aggregate information about a statistical database that prevents publishing private information about individual records whose data are contained in the database. For example, some government agencies use differentially private algorithms to publish demographic data or other statistical aggregates while maintaining the confidentiality of survey responses. Businesses use them to collect information about user behavior while limiting what is visible to even internal analysts.Differential privacy is usually considered when identifying persons whose information may be saved in a database. Although it does not explicitly address issues of identification and reidentification, differentially private algorithms are expected to be immune to such attacks. A differentially secret algorithm is one in which the observer who sees the output has no way of knowing if the computation utilizes the information of a specific individual.The proposed methodology ensures the integrity of the data synthesis from heterogeneous sources while guaranteeing the anonymity and reliability of the data even in cases of the use of the data in question by third-party analysts [12, 24].Specifically, having the problem of data fusion from N sensors, its modeling turns into the following optimization problem [13, 25, 26]:(1)uz=maxzi1i2i3∑i1=0M1∑i2=0M2∑i3=0M3Ci1i2i3zi1i2i3,if the following restrictions apply(2)∑i2=0M2∑i3=0M3zi1i2i3=1,i1=1,2,…,M1,∑i1=0M1∑i3=0M3zi1i2i3=1,i2=1,2,…,M2,∑i1=0M1∑i2=0M2zi1i2i3=1,i3=1,2,…,MS.According to Lagrange's relaxation method [22], a set of constraints is subtracted and expressed with the help of Lagrange multipliers in the objective function of the above equation. The motivation for this approach is that a proper selection of Lagrange multipliers will tend to satisfy the inherent limitations typically found in a similar problem [27]. Thus, the three-dimensional assignment problem becomes a two-dimensional assignment problem [28].We assume that we have S sets of measurements fromNS sensors, which monitor an athlete and detect target points. Still, the number is not necessarily equal to the number of actual targets set in training. The S-dimensional problem is presented as follows [4, 9, 15]:(3)max∑i1=0M1⋯∑iS=0MSCi1…iSzi1…iS.Given the fact that(4)∑i2=0M2⋯∑is=0MSzi1⋯iS=1,i1=1,2,…,M1,∑i1=0M1⋯∑is=0MSzi1⋯iS=1,i2=1,2,…,M2,⋯∑i1=0M1⋯∑is−1=0MS−1zi1⋯iS=1,iS=1,2,…,MS.The multipliers Lagrangeur, r = S, S − 1, ... ,3 and the constraints of the above equations are defined in relation to the cost function. So, the following r “loose” subproblem arises [29]:(5)wi1⋯irr=∑ir+1=0Mr+1⋯∑iS=0MSzi1…iS=∑ir+1=0Mr+1wi1⋯ir+1r+1,di1…ir=maxir+1⋯maxisci1⋯iS+ur+1ir+1⋯+uSis=maxir+1dr+1i1..ir+1+ur+1ir+1.Obviously, we have(6)di1⋯iSS=ci1…iS.Ther subproblem can be written as follows:(7)maxwi1−ir∑i1=0M1∑i2=0M2⋯∑ir=0Mrdii1.irwi1..irrr−∑ir+1=0Mr+1ur+1ir+1⋯−∑is=0MSuSiS.Given the fact that [30](8)∑i2=0M2⋯∑is=0MSwi1..irr=1,i1=1,2,…,M1,∑i1=0M1⋯∑is=0MSwi1..irr=1,i2=1,2,…,M2,∑i1=0M1⋯∑ir−1=0MS−1wi1..irr=1,ir=1,2,…,Mr.So for a given set of Lagrange multipliers, ther subproblem is a generalized assignment problem, where r ≤ S. We defined the binary problem because Lagrange multipliers will impose a kind of “punishment” on the relaxed constraints violated by the solution.Because anonymizing the data set several times is not enough to protect the data from a solid and well-prepared attacker, for example, in an n-element database, a specific feature knower of n−1 objects can easily infer the value of the individual attribute that remains, and in this research, we use differential privacy, which is an interactive method that protects data, even from attackers with prior knowledge of it [31].Givene > 0, a randomized function M yields e-differential privacy, if for every data set x, x′ with x ∼ x′ and every S ⊆ RM, where RM is the set of values of M [32, 33].(9)PMx∈S≤eε⋅PMx′∈S.Ase we consider a small, not negligible, positive number, usually in the interval (0.01, ln2), the lower the price, the greater the protection of records. The definition ceases to be useful if e < 1/n. We also consider n as universally known information. We observe that the relation can be written equivalently as follows:(10)PMx′∈S≤eε⋅PMx∈S,due to the symmetry resulting from the definition of the proximity of the bases. The concept of differential privacy assures us that the attacker cannot deduce from the image of M, most likely, if the data from a single record have changed. In some cases, it is helpful to consider a generalization of the definition.(11)PMx∈S≤eε⋅PMx′∈S+δ.The higher thed > 0, the easier it is for an attacker to distinguish which base is x′ and x. The initial definition (with d = 0) is safer. In short, term d represents the possibility that some people may lose more privacy than others and that the multiplication barrier does not apply to everyone. If d is too small, this risk is too small [34]. An overview of how differential privacy is used is shown in Figure 1.Figure 1
Differential privacy (probability density vs. differential privacy output).In general, it is true that even a mechanism M :X - ⟶ B provides e-differential privacy. Then, for each function f, the composition f ◦ M maintains e-differential privacy. And this is true whether we have a sequential or adaptive composition as they will maintain (ε1 + ε2)-differential privacy. Even in the case of advanced composition, for each ε, δ, δ′ ≥ 0, the mechanism created by the adaptive synthesis of k mechanisms with (ε, δ)-differential privacy provides (ε′, kδ + δ′)-differential privacy with(12)ε′=2klog1δ′ε+kεeε−1.The above synthesis theorems cover both the repetitive application of differential privacy mechanisms in the same database and their repetitive application in different databases that may, however, contain information related to a specific record.


## 4. Use Case

For the modeling of the proposed system, a specialized differential privacy scenario was implemented with data derived from sensor fusion. It should be emphasized that the architecture of the models managing the randomization mechanisms is entirely different from that of the generalization mechanisms. Most algorithms use the technique to accept a set of data and return an anonymized version of it. However, the use of interactive techniques requires different modeling, and, for a question posed by a third party in the athlete's information fusion database, the administrator chooses the amount of privacy they wish to convey. The data are processed, noise is added, and the analyzer returns the result.In the following modeling, we mainly use the Laplace mechanism, which satisfies a dynamic differential privacy criterion to implement different levels of privacy in the information distributed to third parties [35].Letq be a set of values R, and let ∆ be its l1-sensitivity. Then, the mechanism [20, 33](13)Mx=qx+z,with z ∼ Lap(∆|ε), provides e-differential privacy.The size of the noise depends on the type of query and the selection ofe. So for a counting query we want order noise ∼ Lap(1|e), while the smaller the value of ε, the more inaccurate the result. We introduce the x-database with the athlete's heart rate and query the average heart rate [36].(14)qx=∑i=1nxin,with xi ∈ [0, xmax]. If we use a neighborhood relation of type xi−xi′ ≤ xmax, then the sensitivity of the query will be(15)Δ=maxx∼x′qx−qx′=1nmaxxi,xi′xi−xi′i∈1,n.So we have(16)Δ=xmaxn.According to the above, the mechanism becomes(17)Mx=∑i=1nxin+Lapxmaxnε,and will maintain e-differential privacy. We observe that the magnitude of the noise resulting from the Laplace mechanism is inversely proportional to the number n of recordings, which is to be expected since, intuitively, we expect better privacy if the size of the base is large.The probability density function for mean µ = 0 is(18)fx|0,b=12be−x/b.So we have the cumulative distribution function(19)Fx=∫−∞xfudu,=∫−∞x12be−u/bdu,=12ex/b,x<0,1−12e−x/b,x≥0.The inverse function is(20)F−1x=b⋅ln2x,0<x<12,−b⋅ln2−2x,12≤x≤1.Settingu = x - 1/2, we end up with a generator of random variables [32].(21)X=−b⋅sgnuln1−2uu∈−12,12.Thus, by selecting random variablesu from the uniform distribution in the interval [−0.5, 0.5], the random variable X will belong to the Laplace distribution with scale parameter b. We construct two different functions. The relation that connects e with the parameter b is(22)b=Δfε,with ∆f denoting the sensitivity of a function f:X⟶ℝk.(23)Δf=maxx∼x′fx−fx′,where x, x′ are two adjacent databases.To prove the above, we apply the proposed framework to the classic query experiment to find the mean value of a sensitive, numerical attribute. Specifically, we present in detail the methodology for finding the mean value of the heartbeat feature.The heartbeat can be an indication of a person's physical condition. The average resting heart rate is between 70 and 75 beats per minute. People who do regular aerobic exercise reach 50 to 60 beats per minute. Professional athletes can have only 30 to 35 beats per minute, while people with poor fitness can go 90 or 100 beats per minute.So we will have(24)fx=1n∑i=1nbi.Athlete A's score values range from [30,bmax]. We notice that(25)bi−bi′≤bmax−30.Therefore, the sensitivity can be calculated as follows:(26)Δf=maxx∼x′qx−qx′=1nmaxxi,xi′bi−bi′i∈1,n.So we have(27)Δf=bmax−30n.We know that the mechanism(28)Mx=∑i=1nbin+Lapbmax−5nε,will maintain e-differential privacy. Applying the formula to our calculations, we get the results for the average grade.Whene = 1, the average grade = 33.74; when e = 0.1, the average grade = 33.73; and when e = 00.1, the average grade = 33.81, etc.Another option is to add Laplace noise to each point and then calculate their average value.


## 5. Conclusions

To secure athletes' data collected and analyzed by sports wearables, this paper presents an innovative and highly flexible privacy-preserving sports wearable data fusion framework. It is an advanced methodology for protecting privacy in synthesized databases. Specifically, the procedure is based on the Lagrange relaxation method for the problem of multiple assignments and the synthesis of information from numerous sensors. Data are secured using a flexible, adaptive differential privacy system. Using Laplace noise allows access to databases with personal information, ensuring that this information will remain personal without a third party being able to reveal the identity of the athlete who provided the data in question.This technique is an initial privacy-preserving framework for maintaining data mining confidentiality. When data are transferred or shared between different parties, it is mandatory to provide security so that other parties do not know what information is being shared between the original parts, identifying the users. In general, this methodology helps hide the knowledge of sports data output as the output data are valuable and private, thus contributing to the shielding of defense mechanisms related to the sports industry.



---

*Source: 6131971-2022-05-04.xml*