Abstract
Ubiquitous computing has fundamentally redefined many existing business models. The collected sensor data has great potential, which is being recognized by more and more industries, including car insurance companies with Usage-Based Insurance (UBI). However, most of these business models are very privacy-invasive and must be constructed with care. For a data processor, the integrity of the data is particularly important. With kUBI, we present a framework that takes into account the interests of the providers as well as the privacy of the users, using the example of Android. It is fully integrated into the Android system architecture. It uses hybrid data processing in both stakeholder domains. Protected enclaves, whose function can be transparently traced by a user at any time, protect company secrets in the hostile environment, i.e. a user’s smartphone. The framework is theoretically outlined and its integration into Android is shown. An evaluation shows that the user in the exemplary use case UBI can be protected by kUBI.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
We use \(\{\}\) to denote such an ordered set and [] to specify an unordered list.
References
Android: Trusty TEE | Android Open Source Project (2016). https://source.android.com/security/trusty
Android: Sensors | Android Open Source Project (2020). https://source.android.com/devices/sensors
Bai, X., Yin, J., Wang, Y.-P.: Sensor guardian: prevent privacy inference on Android sensors. EURASIP J. Inf. Secur. 2017(1), 1–17 (2017). https://doi.org/10.1186/s13635-017-0061-8
Bal, G., Rannenberg, K., Hong, J.I.: Styx: privacy risk communication for the Android smartphone platform based on apps’ data-access behavior patterns. Comput. Secur. 53, 187–202 (2015)
Benndorf, V., Normann, H.T.: The willingness to sell personal data. Scand. J. Econ. 120, 1260–1278 (2018)
Bugiel, S., Heuser, S., Sadeghi, A.R.: Flexible and fine-grained mandatory access control on android for diverse security and privacy policies. In: Proceedings of the 22nd USENIX Security Symposium, pp. 131–146 (2013)
Chakraborty, S., Raghavan, K.R., Johnson, M.P., Srivastava, M.B.: A framework for context-aware privacy of sensor data on mobile systems. In: Proceedings of the 14th Workshop on Mobile Computing Systems and Applications - HotMobile ’13, p. 1. ACM Press, New York (2013)
EY: Introducing ‘Pay How You Drive’ (PHYD) Insurance - Insurance that rewards safe driving (2016)
Felt, A.P., Ha, E., Egelman, S., Haney, A., Chin, E., Wagner, D.: Android permissions: user attention, comprehension, and behavior. In: SOUPS 2012 - Proceedings of the 8th Symposium on Usable Privacy and Security (2012)
Greaves, S., De Gruyter, C.: Profiling driving behaviour using passive global positioning system (GPS) technology. In: Outside the Square, Operations, Transport and Safety (2002)
Hemminki, S., Nurmi, P., Tarkoma, S.: Accelerometer-based transportation mode detection on smartphones. In: SenSys 2013 - Proceedings of the 11th ACM Conference on Embedded Networked Sensor Systems. Association for Computing Machinery (2013)
Hong, S.K., Gurjar, K., Kim, H.S., Moon, Y.S.: A survey on privacy preserving time-series data mining. In: 3rd International Conference on Intelligent Computational Systems (ICICS’2013) (2013)
Kang, R., Dabbish, L., Fruchter, N., Kiesler, S.: “My data just goes everywhere”: user mental models of the internet and implications for privacy and security. Symp. Usable Priv. Secur. (SOUPS) 2015, 39–52 (2015)
Kreuter, F., Haas, G.C., Keusch, F., Bähr, S., Trappmann, M.: Collecting survey and smartphone sensor data with an app: opportunities and challenges around privacy and informed Consent. Soc. Sci. Comput. Rev. 38, 533–549 (2018)
Li, Z., Pei, Q., Markwood, I., Liu, Y., Pan, M., Li, H.: Location privacy violation via GPS-agnostic smart phone car tracking. IEEE Trans. Veh. Technol. 67, 5042–5053 (2018)
Litman, T.A.: Pay-as-you-drive pricing for insurance affordability. Victoria Transp. Policy Inst. 10(June), 19 (2011)
Martínez, M.V., Echanobe, J., Del Campo, I.: Driver identification and impostor detection based on driving behavior signals. In: IEEE Conference on Intelligent Transportation Systems, Proceedings, ITSC, pp. 372–378 (2016)
Mylonas, A., Theoharidou, M., Gritzalis, D.: Assessing privacy risks in android: a user-centric approach. In: Bauer, T., Großmann, J., Seehusen, F., Stølen, K., Wendland, M.-F. (eds.) RISK 2013. LNCS, vol. 8418, pp. 21–37. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-07076-6_2
Pfitzmann, A., Pfitzmann, B., Schunter, M., Waidner, M.: Trusting mobile user devices and security modules. Computer 30(2), 61–68 (1997)
Roth, C., Aringer, S., Petersen, J., Nitschke, M.: Are sensor-based business models a threat to privacy? the case of pay-how-you-drive insurance models. In: Gritzalis, S., Weippl, E.R., Kotsis, G., Tjoa, A.M., Khalil, I. (eds.) TrustBus 2020. LNCS, vol. 12395, pp. 75–85. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-58986-8_6
Solove, D.J.: Nothing to Hide: The False Tradeoff Between Privacy and Security. Yale University Press, New Haven (2011)
Troncoso, C., Danezis, G., Kosta, E., Preneel, B.: PriPAYD: privacy friendly pay-as-you-drive insurance. In: WPES 2007 - Proceedings of the 2007 ACM Workshop on Privacy in Electronic Society, vol. 8, pp. 742–755 (2007)
Tselentis, D.I., Yannis, G., Vlahogianni, E.I.: Innovative insurance schemes: pay as/how you drive. Transp. Res. Procedia 14, 362–371 (2016)
Weydert, V., Desmet, P., Lancelot-Miltgen, C.: Convincing consumers to share personal data: double-edged effect of offering money. J. Consum. Mark. 37, 1–9 (2019)
Zhang, J., Beresford, A.R., Sheret, I.: SensorID: sensor calibration fingerprinting for smartphones. In: Proceedings of the 40th IEEE Symposium on Security and Privacy (SP). IEEE (2019)
Zhang, L., Pathak, P.H., Wu, M., Zhao, Y., Mohapatra, P.: AccelWord: energy efficient hotword detection through accelerometer. In: MobiSys 2015 - Proceedings of the 13th Annual International Conference on Mobile Systems, Applications, and Services, pp. 301–315. Association for Computing Machinery Inc, New York (May 2015)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Roth, C., Saur, M., Kesdogan, D. (2020). kUBI: A Framework for Privacy and Transparency in Sensor-Based Business Models for Consumers: A Pay-How-You-Drive Example. In: Boureanu, I., et al. Computer Security. ESORICS 2020. Lecture Notes in Computer Science(), vol 12580. Springer, Cham. https://doi.org/10.1007/978-3-030-66504-3_7
Download citation
DOI: https://doi.org/10.1007/978-3-030-66504-3_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-66503-6
Online ISBN: 978-3-030-66504-3
eBook Packages: Computer ScienceComputer Science (R0)