Avoiding privacy violations caused by context-sensitive services.pdfVIP

Avoiding Privacy Violations Caused by Context-Sensitive Services Urs Hengartner University of Waterloo uhengart@cs.uwaterloo.ca Peter Steenkiste Carnegie Mellon University prs@ Abstract The increasing availability of information about people’s context makes it possible to deploy context-sensitive ser- vices, where access to resources provided or managed by a service is limited depending on a person’s context. For example, a location-based service can require an individ- ual to be at a particular location in order to let the indi- vidual use a printer or learn her friends’ location. How- ever, constraining access to a resource based on confiden- tial information about a person’s context could result in privacy violations. For instance, if access is constrained based on a person’s location, granting or rejecting access will provide information about this person’s location and could violate the person’s privacy. We introduce an access- control algorithm that avoids privacy violations caused by context-sensitive services. Our algorithm exploits the con- cepts of access-rights graphs, which represent all the infor- mation that needs to be collected in order to make a context- sensitive access decision. Moreover, we introduce hidden constraints, which keep some of this information secret and thus allow for more flexible access control. We present a distributed, certificate-based access-control architecture for context-sensitive services that avoids privacy violations, a sample implementation, and a performance evaluation. 1. Introduction The increasing numbers of networked devices (e.g., cell- phones or handhelds) that individuals are carrying and of networked sensors (e.g., cameras) let more context-sensitive information about people become electronically available. This trend enables the deployment of context-sensitive ser- vices, where access to resources provided or managed by a service depends on a person’s context. For instance, many pervasive computing projects pro