Grant: Discovery Grants Program - Individual

Privacy presents one of the chief impediments to widespread adoption of the Internet of Things (IoT). The progressive pace of IoT evolution is likely to further aggravate privacy concerns, as it weaves itself into our everyday interactions, with ever increasing sophistication and accuracy in its embedded sensors. The ultimate source of user discomfort though is the lack of control over personal data that is directly streamed from sensors to the outside world. Data collected at high granularity could reveal sensitive information pertaining, for instance, to physical mobility, financial circumstances, health issues, and religious preferences. Access control and privacy preserving approaches need to be revisited and carefully redesigned to cope with dynamically changing contexts in IoT, satisfy varying user needs, provide more flexibility to data providers and better protection for consumers. Current access control mechanisms provide access based on the identity of the requesting entity, failing to capture the unique characteristics of IoT, its interconnected systems, and its growing user demands. Given the unpredictable usage of IoT data, access control architectures must allow for flexible access policy definitions to support diverse usage needs. Introducing such kinds of flexibility while maintaining the generality of the access framework remains a significant challenge. Additionally, people are not always aware of data collection in open environments that may compromise their privacy. The concept of announcing personal privacy preferences to collecting entities and enforcing such preferences is entirely lacking. The objective of this research is to develop a holistic privacy preserving framework that integrates privacy into IoT systems from the ground up. This will accelerate adoption of IoT, lowering the barriers for users to better manage their privacy, and demonstrating best practices for interoperability across the entire heterogeneous IoT ecosystem. This research program will address IoT privacy challenges from three directions. We propose to (1) develop robust access control techniques that cope with highly dynamic and open IoT environments, aiming to tightly control access to IoT devices, (2) Design and develop a personal privacy broker module that users can trust to monitor data collection, manage access to their private data, and continuously enforce their privacy preferences/policies in IoT-enabled environments, (3) Devise a robust, dynamic and semantic-based context management platform to support real-time decision making in both access control and privacy brokers. This research program will support 10 students who will receive specialized training in a leading research lab using cutting-edge facilities. The outcomes promise to improve Canadians' ability to utilize smart city services that can offer a better quality of life, in domains varying from business intelligence to health informatics, without sacrificing their privacy.