We have more and more devices connected to the Internet at home. Smart speakers, security cameras, other devices smart and devices of the Internet of Things, put on the table the doubts that arise around our privacy and the management of it.
Currently, there is no certain way to verify that these devices are limited to working only with what they need, but CyLab researchers are close to finding a solution.
Controlling the margins of action of smart devices
“People are concerned that their devices are capturing and sharing too much data«, commented Haojian Jin of CyLab, a Ph.D. from the Human-Computer Interaction Institute at Carnegie Mellon University. “Companies want to tell users that they only collect certain information, but they currently have no way to prove it”.
To address these concerns, Jin and a team of researchers developed a new privacy control architecture for developers to implement in their smart home apps. The system, called Peekaboo, receives developers’ requests to share certain data and ensures that only data essential to fulfilling their request is shared with them.
“In the world of privacy, we have a principle called ‘data minimization’Jin says. “The companies that collect the data should only collect the minimum amount of data to meet their objectives”.
This concept is even written into the EU General Data Protection Regulation (GDPR), Jin points out. Article 5 (1) (c) of this regulation says: “Personal data will be limited to what is necessary in relation to the purposes for which they are processed”.
Under Peekaboo filters, developers first need to declare all the data they intend to collect and under what conditions: it is important to be precise about where that data is sent and the granularity of the data itself; for example, if they would like to collect the number of hours viewed. on a smart TV per week, per month, per quarter, etc. Next, a hub in the home acts as a mediator between all the devices in the home and the outside Internet.
“The hub forces the sharing of only the data declared by the developer”Jin says. «And users and external auditors can inspect incoming data requests as well as outgoing data streams.”.
The vocation of the Peekaboo architecture, says Jin, is that users can have more control over their data. If a developer requests permission to collect information (for example, if they want to know the number of hours spent watching a smart TV in a single day), the user can modify the request in the hub of this system, to share only the number of hours they spend watching their smart TV for a whole month, if they feel more comfortable with that.
The purpose of this proposal, in addition to granting greater control over privacy, is to guarantee it in a comfortable and accessible way. “The Peekaboo protocol will allow users to manage privacy preferences for all their devices centrally through the hub”Jin pointed out. “Imagine not just a privacy nutrition label for an individual device, but a privacy nutrition label for an entire home”.
This system was disclosed in detail through a paper titled “Peekaboo: A Hub-Based Approach to Enable Transparency in Data Processing within Smart Homes”presented at the IEEE Symposium on Security and Privacy last week.
