Data De-identification Framework

As technology develops,the amount of information being used has increased a lot.Every company learns big data to provide customized services with its customers.Accordingly,collecting and analyzing data of the data subject has become one of the core competencies of the companies.However,when collecting and using it,the authority of the data subject may be violated.The data often identifies its subject by itself,and even if it is not a personal information that infringes on an individual’s authority,the moment it is connected,it becomes important and sensitive personal information that we have never thought of.Therefore,recent privacy regulations such as GDPR(GeneralData ProtectionRegulation)are changing to guarantee more rights of the data subjects.To use data effectively without infringing on the rights of the data subject,the concept of de-identification has been created.Researchers and companies can make personal information less identifiable through appropriate de-identification/pseudonymization and use the data for the purpose of statistical research.De-identification/pseudonymization techniques have been studied a lot,but it is difficult for companies and researchers to know how to de-identify/pseudonymize data.It is difficult to clearly understand how and to what extent each organization should take deidentification measures.Currently,each organization does not systematically analyze and conduct the situation but only takes minimal action while looking at the guidelines distributed by each country.We solved this problem from the perspective of risk management.Several steps are required to secure the dataset starting from pre-processing to releasing the dataset.We can analyze the dataset,analyze the risk,evaluate the risk,and treat the risk appropriately.The outcomes of each step can then be used to take appropriate action on the dataset to eliminate or reduce its risk.Then,we can release the dataset under its own purpose.These series of processes were reconstructed to fit the current situation by analyzing various standards such as ISO/IEC(International Organization for Standardization/International Electrotechnical Commission)20889,NIST IR(National Institute of Standards and Technology Interagency Reports)8053,NIST SP(National Institute of Standards and Technology Special Publications)800-188,and ITU-T(International Telecommunications Union-Telecommunication)X.1148.We propose an integrated framework based on situational awareness model and risk management model.We found that this framework can be specialized for multiple domains,and it is useful because it is based on a variety of case and utility-based ROI calculations.

Cybersecurity and Privacy Protection in Vehicular Networks (VANETs)

As Vehicular ad hoc networks (VANETs) become more sophisticated, the importance of integrating data protection and cybersecurity is increasingly evident. This paper offers a comprehensive investigation into the challenges and solutions associated with the privacy implications within VANETs, rooted in an intricate landscape of cross-jurisdictional data protection regulations. Our examination underscores the unique nature of VANETs, which, unlike other ad-hoc networks, demand heightened security and privacy considerations due to their exposure to sensitive data such as vehicle identifiers, routes, and more. Through a rigorous exploration of pseudonymization schemes, with a notable emphasis on the Density-based Location Privacy (DLP) method, we elucidate the potential to mitigate and sometimes sidestep the heavy compliance burdens associated with data protection laws. Furthermore, this paper illuminates the cybersecurity vulnerabilities inherent to VANETs, proposing robust countermeasures, including secure data transmission protocols. In synthesizing our findings, we advocate for the proactive adoption of protective mechanisms to facilitate the broader acceptance of VANET technology while concurrently addressing regulatory and cybersecurity hurdles.

Random but System-Wide Unique Unlinkable Parameters

When initializing cryptographic systems or running cryptographic protocols, the randomness of critical parameters, like keys or key components, is one of the most crucial aspects. But, randomly chosen parameters come with the intrinsic chance of duplicates, which finally may cause cryptographic systems including RSA, ElGamal and Zero-Knowledge proofs to become insecure. When concerning digital identifiers, we need uniqueness in order to correctly identify a specific action or object. Unfortunately we also need randomness here. Without randomness, actions become linkable to each other or to their initiator’s digital identity. So ideally the employed (cryptographic) parameters should fulfill two potentially conflicting requirements simultaneously: randomness and uniqueness. This article proposes an efficient mechanism to provide both attributes at the same time without highly constraining the first one and never violating the second one. After defining five requirements on random number generators and discussing related work, we will describe the core concept of the generation mechanism. Subsequently we will prove the postulated properties (security, randomness, uniqueness, efficiency and privacy protection) and present some application scenarios including system-wide unique parameters, cryptographic keys and components, identifiers and digital pseudonyms.

Low Cost and Reliable Anonymity Protocols in P2P Reputation Systems

In peer-to-peer (P2P) reputation systems,each peer's trustworthiness is evaluated based on its pseudonym's rating values given by other peers. Since it is assumed that each peer has a long lived pseudonym,all the transactions conducted by the same peer may be linked by its pseudonym. Therefore,one of the fundamental challenges in P2P reputation systems is to protect peers' identity privacy. In this paper,we present two independent anonymity protocols to achieve all the peers' anonymity by changing pseudonym with the help of a trusted third party (TTP) server. Compared with RuP (Reputation using Pseudonym),an existing representative scheme,our protocols reduce the server's cost in two different ways. First,we propose a protocol using blind signature scheme as in RuP. The protocol improves the blind signature scheme and assessment of macro-node values,and reduces the server's cost by half in terms of encryption and decryption operations and message overhead. Second,we propose another protocol,group-confusion protocol,to further reduce the server's cost.