Undocumented immigrants in the United States face risks of discrimination, surveillance, and depo... more Undocumented immigrants in the United States face risks of discrimination, surveillance, and deportation. We investigate their technology use, risk perceptions, and protective strategies relating to their vulnerability. Through semi-structured interviews with Latinx undocumented immigrants, we find that while participants act to address offline threats, this vigilance does not translate to their online activities. Their technology use is shaped by needs and benefits rather than risk perceptions. While our participants are concerned about identity theft and privacy generally, and some raise concerns about online harassment, their understanding of government surveillance risks is vague and met with resignation. We identify tensions among self-expression, group privacy, and self-censorship related to their immigration status, as well as strong trust in service providers. Our findings have implications for digital literacy education, privacy and security interfaces, and technology design in general. Even minor design decisions can substantially affect exposure risks and well-being for such vulnerable communities.
Cooperative Intelligent Transportation Systems must incorporate privacy-enhancing mechanisms to g... more Cooperative Intelligent Transportation Systems must incorporate privacy-enhancing mechanisms to gain public acceptance. The PRECIOSA Privacy-enforcing Runtime Architecture (PeRA) provides a data-centric protection chain, which ensures that ITS components process data according to attached user-defined privacy policies. PeRA instances constitute a distributed privacy middleware that evaluates privacy policies to mediate data access by applications. An integrity protection layer creates a distributed policy enforcement perimeter between ITS nodes to prevent circumvention of policies. The PeRA has been implemented as a proof-of-concept prototype.
Journal of Theoretical and Applied Electronic Commerce Research, 2010
In-network data aggregation is a promising communication mechanism to reduce bandwidth requiremen... more In-network data aggregation is a promising communication mechanism to reduce bandwidth requirements of applications in vehicular ad-hoc networks (VANETs). Many aggregation schemes have been proposed, often with varying features. Most aggregation schemes are tailored to specific application scenarios and for specific aggregation operations. Comparative evaluation of different aggregation schemes is therefore difficult. An application centric view of aggregation does also not tap into the potential of cross application aggregation. Generic modeling may help to unlock this potential. We outline a generic modeling approach to enable improved comparability of aggregation schemes and facilitate joint optimization for different applications of aggregation schemes for VANETs. This work outlines the requirements and general concept of a generic modeling approach and identifies open challenges.
A primary goal of vehicular communication systems is the enhancement of traffic safety by equippi... more A primary goal of vehicular communication systems is the enhancement of traffic safety by equipping vehicles with wireless communication units to facilitate cooperative awareness. Privacy issues arise from the frequent broadcasting of real-time positioning information. Thus privacy protection becomes a key factor for enabling widespread deployment. At the same time, stakeholders demand accountability due to the safety-critical nature of many applications. Earlier works on privacy requirements for vehicular networks often discussed them as a part of security. Therefore many aspects of privacy requirements have been overlooked. In this paper, we identify a structured and comprehensive set of privacyrelated requirements for vehicular communication systems, and analyze the complex inter-relations among them. Our results enable system designers to better understand privacy issues in vehicular networks and properly address privacy requirements during the system design process. We further show that our requirements set facilitates the comparison and evaluation of different privacy approaches for vehicular communication systems.
Network communication using unprotected air as a medium leads to unique challenges ensuring confi... more Network communication using unprotected air as a medium leads to unique challenges ensuring confidentiality, integrity and availability. While newer amendments of IEEE 802.11 provide acceptable confidentiality and integrity, availability is still questionable despite broad usage of Wi-Fi technologies for tasks where availability is critical. We will present new security weaknesses that we have identified in the 802.11 standard and especially the 802.11h amendment. Our results are underlined by an extensive analysis of attacks addressing the quiet information element and channel switch announcement in management frames. For some stations a complete DoS effect can be achieved with a single packet for more than one minute. This shows that the newly identified attacks are more efficient than earlier approaches like a deauthentication attack. Tests were performed with a large variety of network interface cards, mobile devices, and operating systems.
Privacy is an important issue in future vehicle networks, because vehicles broadcast detailed inf... more Privacy is an important issue in future vehicle networks, because vehicles broadcast detailed information. Also of importance is accountability due to safety critical applications. Conditional pseudonymity, i.e., the usage of resolvable pseudonyms, is a common approach to address both. Often, resolvability of pseudonyms is achieved by authorities maintaining pseudonym-identity mappings. However, these mappings are privacy sensitive and require strong protection to prevent abuse or involuntary leakage. We present a new approach that does not rely on pseudonym-identity mappings to be stored by any party. Resolution information is directly embedded in pseudonyms and can only be accessed when multiple authorities cooperate for identity resolution. Our privacy-preserving pseudonym issuance protocol ensures that pseudonyms contain valid resolution information but prevents issuing authorities from creating pseudonym-identity mappings.
One often cited use case for vehicular networks are applications that relate to emergency vehicle... more One often cited use case for vehicular networks are applications that relate to emergency vehicles. In addition to the traditional siren, they could use radio communication to warn other vehicles or to preempt traffic lights. Such an application can reduce accident risks during emergency response trips and also help save valuable time. We outline a comprehensive design of such an emergency vehicle warning system that makes full use of inter-vehicle communication, but also encompasses roadside infrastructure like traffic lights. In our system, other vehicles are not simply warned of an approaching emergency vehicle; they also receive detailed route information. Based on this information, timely and appropriate reaction of other drivers is possible. A prototype of our system has been tested in a traffic environment including emergency vehicles and traffic lights. To identify requirements and evaluate our system, we also conducted a detailed analysis of videos from emergency response trips and an expert survey among members of a local emergency response organization. We will use VANET to refer to any kind of V2V/V2I communication. 2 sim TD:
In ubiquitous systems control of privacy settings will be increasingly difficult due to the perva... more In ubiquitous systems control of privacy settings will be increasingly difficult due to the pervasive nature of sensing and communication capabilities. We identify challenges for privacy decisions in ubiquitous systems and propose a system for in situ privacy decision support. When context changes occur, the system adapts a user's privacy preferences to the new situation. As a consequence, recommendations can be offered to the user or sharing behavior can be automatically adjusted to help the user maintain a desired level of privacy. The system learns from user interaction and behavior to improve decision accuracy. In this paper, we outline the main components of our system and illustrate its operation with an ambient assisted living use case.
Smartphones define a trend towards increasing combination and integration of sensing capabilities... more Smartphones define a trend towards increasing combination and integration of sensing capabilities with almost ubiquitous inter-connectivity. Resulting location-based services and context-aware applications will benefit users by adapting better to the user application needs. However, there is a lack of effective means for controlling privacy in such systems which will likely increase further with future ubiquitous computing systems. Territorial privacy is a concept that moves away from the information-centric view in traditional systems to a context-centric approach. In this paper, we define and model territorial privacy in the context of ubiquitous computing. We further discuss potential observers and disturbers in our model and provide an overview on how territorial privacy can be controlled in different environments, ranging from personal to public.
Page 1. Towards Territorial Privacy in Smart Environments Bastian Könings, Florian Schaub, Michae... more Page 1. Towards Territorial Privacy in Smart Environments Bastian Könings, Florian Schaub, Michael Weber Ulm University Albert-Einstein-Allee 11, 89081 Ulm Germany [email protected] Frank Kargl University ...
The multitude of applications envisioned for vehicular ad hoc networks requires efficient communi... more The multitude of applications envisioned for vehicular ad hoc networks requires efficient communication and dissemination mechanisms to prevent network congestion. In-network data aggregation promises to reduce bandwidth requirements and enable scalability in large vehicular networks. However, most existing aggregation schemes are tailored to specific applications and types of data. Proper comparative evaluation of different aggregation schemes is difficult. Yet, comparability is essential to properly measure accuracy, performance, and efficiency. We outline a modeling approach for VANET aggregation schemes to achieve objective comparability. Our modeling approach consists of three models, which provide different perspectives on an aggregation scheme. The generalized architecture model facilitates categorization of aggregation schemes. The aggregation information flow model supports analysis of where information is aggregated by a scheme. The aggregation state graph models how knowledge about the road network and its environment is represented by a scheme. Furthermore, it facilitates error estimation with respect to the ground truth. We apply each modeling approach to existing aggregation schemes from the literature and highlight strengths, as well as weaknesses, that can be used as a starting point for designing a more generic aggregation scheme.
Automotive navigation systems, especially portable navigation devices (PNDs), are gaining popular... more Automotive navigation systems, especially portable navigation devices (PNDs), are gaining popularity worldwide. Drivers increasingly rely on these devices to guide them to their destination. Some follow them almost blindly, with devastating consequences if the routing goes wrong. Wrong messages as well as superfluous and unnecessary messages can potentially reduce the credibility of those devices. We performed a comparative study with current PNDs from different vendors and market segments, in order to assess the extent of this problem and how it is related to the interaction between device and driver. In this paper, we report the corresponding results and identify multiple interaction weaknesses that are prevalent throughout all tested device classes.
With the rise of online social networks, sharing of personal information online has become the ru... more With the rise of online social networks, sharing of personal information online has become the rule for many people rather than the exception. However, users have only limited abilities to effectively control privacy of their posted information. Even gaining an overview of posted information is already a difficult task. We propose a privacy control system for personal information online. PrivacyJudge allows fine-grained access control to posted information and provides a comprehensive overview of previously posted data. Thereby, PrivacyJudge does not require cooperation of service providers, instead operation remains transparent to them. Thus effectively providing privacy protection against other users and service providers alike. Pri-vacyJudge follows a hybrid approach combining cryptographic enforcement with social signaling to achieve privacy protection beyond technical enforcement boundaries by leveraging system trust as well as social trust mechanisms.
Undocumented immigrants in the United States face risks of discrimination, surveillance, and depo... more Undocumented immigrants in the United States face risks of discrimination, surveillance, and deportation. We investigate their technology use, risk perceptions, and protective strategies relating to their vulnerability. Through semi-structured interviews with Latinx undocumented immigrants, we find that while participants act to address offline threats, this vigilance does not translate to their online activities. Their technology use is shaped by needs and benefits rather than risk perceptions. While our participants are concerned about identity theft and privacy generally, and some raise concerns about online harassment, their understanding of government surveillance risks is vague and met with resignation. We identify tensions among self-expression, group privacy, and self-censorship related to their immigration status, as well as strong trust in service providers. Our findings have implications for digital literacy education, privacy and security interfaces, and technology design in general. Even minor design decisions can substantially affect exposure risks and well-being for such vulnerable communities.
Cooperative Intelligent Transportation Systems must incorporate privacy-enhancing mechanisms to g... more Cooperative Intelligent Transportation Systems must incorporate privacy-enhancing mechanisms to gain public acceptance. The PRECIOSA Privacy-enforcing Runtime Architecture (PeRA) provides a data-centric protection chain, which ensures that ITS components process data according to attached user-defined privacy policies. PeRA instances constitute a distributed privacy middleware that evaluates privacy policies to mediate data access by applications. An integrity protection layer creates a distributed policy enforcement perimeter between ITS nodes to prevent circumvention of policies. The PeRA has been implemented as a proof-of-concept prototype.
Journal of Theoretical and Applied Electronic Commerce Research, 2010
In-network data aggregation is a promising communication mechanism to reduce bandwidth requiremen... more In-network data aggregation is a promising communication mechanism to reduce bandwidth requirements of applications in vehicular ad-hoc networks (VANETs). Many aggregation schemes have been proposed, often with varying features. Most aggregation schemes are tailored to specific application scenarios and for specific aggregation operations. Comparative evaluation of different aggregation schemes is therefore difficult. An application centric view of aggregation does also not tap into the potential of cross application aggregation. Generic modeling may help to unlock this potential. We outline a generic modeling approach to enable improved comparability of aggregation schemes and facilitate joint optimization for different applications of aggregation schemes for VANETs. This work outlines the requirements and general concept of a generic modeling approach and identifies open challenges.
A primary goal of vehicular communication systems is the enhancement of traffic safety by equippi... more A primary goal of vehicular communication systems is the enhancement of traffic safety by equipping vehicles with wireless communication units to facilitate cooperative awareness. Privacy issues arise from the frequent broadcasting of real-time positioning information. Thus privacy protection becomes a key factor for enabling widespread deployment. At the same time, stakeholders demand accountability due to the safety-critical nature of many applications. Earlier works on privacy requirements for vehicular networks often discussed them as a part of security. Therefore many aspects of privacy requirements have been overlooked. In this paper, we identify a structured and comprehensive set of privacyrelated requirements for vehicular communication systems, and analyze the complex inter-relations among them. Our results enable system designers to better understand privacy issues in vehicular networks and properly address privacy requirements during the system design process. We further show that our requirements set facilitates the comparison and evaluation of different privacy approaches for vehicular communication systems.
Network communication using unprotected air as a medium leads to unique challenges ensuring confi... more Network communication using unprotected air as a medium leads to unique challenges ensuring confidentiality, integrity and availability. While newer amendments of IEEE 802.11 provide acceptable confidentiality and integrity, availability is still questionable despite broad usage of Wi-Fi technologies for tasks where availability is critical. We will present new security weaknesses that we have identified in the 802.11 standard and especially the 802.11h amendment. Our results are underlined by an extensive analysis of attacks addressing the quiet information element and channel switch announcement in management frames. For some stations a complete DoS effect can be achieved with a single packet for more than one minute. This shows that the newly identified attacks are more efficient than earlier approaches like a deauthentication attack. Tests were performed with a large variety of network interface cards, mobile devices, and operating systems.
Privacy is an important issue in future vehicle networks, because vehicles broadcast detailed inf... more Privacy is an important issue in future vehicle networks, because vehicles broadcast detailed information. Also of importance is accountability due to safety critical applications. Conditional pseudonymity, i.e., the usage of resolvable pseudonyms, is a common approach to address both. Often, resolvability of pseudonyms is achieved by authorities maintaining pseudonym-identity mappings. However, these mappings are privacy sensitive and require strong protection to prevent abuse or involuntary leakage. We present a new approach that does not rely on pseudonym-identity mappings to be stored by any party. Resolution information is directly embedded in pseudonyms and can only be accessed when multiple authorities cooperate for identity resolution. Our privacy-preserving pseudonym issuance protocol ensures that pseudonyms contain valid resolution information but prevents issuing authorities from creating pseudonym-identity mappings.
One often cited use case for vehicular networks are applications that relate to emergency vehicle... more One often cited use case for vehicular networks are applications that relate to emergency vehicles. In addition to the traditional siren, they could use radio communication to warn other vehicles or to preempt traffic lights. Such an application can reduce accident risks during emergency response trips and also help save valuable time. We outline a comprehensive design of such an emergency vehicle warning system that makes full use of inter-vehicle communication, but also encompasses roadside infrastructure like traffic lights. In our system, other vehicles are not simply warned of an approaching emergency vehicle; they also receive detailed route information. Based on this information, timely and appropriate reaction of other drivers is possible. A prototype of our system has been tested in a traffic environment including emergency vehicles and traffic lights. To identify requirements and evaluate our system, we also conducted a detailed analysis of videos from emergency response trips and an expert survey among members of a local emergency response organization. We will use VANET to refer to any kind of V2V/V2I communication. 2 sim TD:
In ubiquitous systems control of privacy settings will be increasingly difficult due to the perva... more In ubiquitous systems control of privacy settings will be increasingly difficult due to the pervasive nature of sensing and communication capabilities. We identify challenges for privacy decisions in ubiquitous systems and propose a system for in situ privacy decision support. When context changes occur, the system adapts a user's privacy preferences to the new situation. As a consequence, recommendations can be offered to the user or sharing behavior can be automatically adjusted to help the user maintain a desired level of privacy. The system learns from user interaction and behavior to improve decision accuracy. In this paper, we outline the main components of our system and illustrate its operation with an ambient assisted living use case.
Smartphones define a trend towards increasing combination and integration of sensing capabilities... more Smartphones define a trend towards increasing combination and integration of sensing capabilities with almost ubiquitous inter-connectivity. Resulting location-based services and context-aware applications will benefit users by adapting better to the user application needs. However, there is a lack of effective means for controlling privacy in such systems which will likely increase further with future ubiquitous computing systems. Territorial privacy is a concept that moves away from the information-centric view in traditional systems to a context-centric approach. In this paper, we define and model territorial privacy in the context of ubiquitous computing. We further discuss potential observers and disturbers in our model and provide an overview on how territorial privacy can be controlled in different environments, ranging from personal to public.
Page 1. Towards Territorial Privacy in Smart Environments Bastian Könings, Florian Schaub, Michae... more Page 1. Towards Territorial Privacy in Smart Environments Bastian Könings, Florian Schaub, Michael Weber Ulm University Albert-Einstein-Allee 11, 89081 Ulm Germany [email protected] Frank Kargl University ...
The multitude of applications envisioned for vehicular ad hoc networks requires efficient communi... more The multitude of applications envisioned for vehicular ad hoc networks requires efficient communication and dissemination mechanisms to prevent network congestion. In-network data aggregation promises to reduce bandwidth requirements and enable scalability in large vehicular networks. However, most existing aggregation schemes are tailored to specific applications and types of data. Proper comparative evaluation of different aggregation schemes is difficult. Yet, comparability is essential to properly measure accuracy, performance, and efficiency. We outline a modeling approach for VANET aggregation schemes to achieve objective comparability. Our modeling approach consists of three models, which provide different perspectives on an aggregation scheme. The generalized architecture model facilitates categorization of aggregation schemes. The aggregation information flow model supports analysis of where information is aggregated by a scheme. The aggregation state graph models how knowledge about the road network and its environment is represented by a scheme. Furthermore, it facilitates error estimation with respect to the ground truth. We apply each modeling approach to existing aggregation schemes from the literature and highlight strengths, as well as weaknesses, that can be used as a starting point for designing a more generic aggregation scheme.
Automotive navigation systems, especially portable navigation devices (PNDs), are gaining popular... more Automotive navigation systems, especially portable navigation devices (PNDs), are gaining popularity worldwide. Drivers increasingly rely on these devices to guide them to their destination. Some follow them almost blindly, with devastating consequences if the routing goes wrong. Wrong messages as well as superfluous and unnecessary messages can potentially reduce the credibility of those devices. We performed a comparative study with current PNDs from different vendors and market segments, in order to assess the extent of this problem and how it is related to the interaction between device and driver. In this paper, we report the corresponding results and identify multiple interaction weaknesses that are prevalent throughout all tested device classes.
With the rise of online social networks, sharing of personal information online has become the ru... more With the rise of online social networks, sharing of personal information online has become the rule for many people rather than the exception. However, users have only limited abilities to effectively control privacy of their posted information. Even gaining an overview of posted information is already a difficult task. We propose a privacy control system for personal information online. PrivacyJudge allows fine-grained access control to posted information and provides a comprehensive overview of previously posted data. Thereby, PrivacyJudge does not require cooperation of service providers, instead operation remains transparent to them. Thus effectively providing privacy protection against other users and service providers alike. Pri-vacyJudge follows a hybrid approach combining cryptographic enforcement with social signaling to achieve privacy protection beyond technical enforcement boundaries by leveraging system trust as well as social trust mechanisms.
Uploads
Papers by Florian Schaub