Abstract
Various devices including our mobile phones are increasingly used as the intermediary (gateway) between IoT peripherals (like the smart lock at our homes) and the larger cloud infrastructure. In this paper we introduce the novel notion of Caveat instances on the cloud together with a novel application of MQTT (the communication protocol designed for peripherals) to stamp our will on how data about us can be used when it travels and resides outside our immediate boundary. Even when we cannot keep our personal data private, we can still prevent it from being misused, for example to commit identity theft, by ensuring that the attacker cannot produce an appropriate attestation for the data.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsNotes
- 1.
- 2.
A institutional building designed by English philosopher Bentham where all the inmates can be observed by an observer without the inmates knowing when they are being observed and when not.
- 3.
- 4.
A file that enumerates to allow or disallow arbitrary access, along with the location of the access control file which lists users allowed to read and/or write to a topic, along with the location of the password file containing user names and passwords the broker can verify.
- 5.
Traditionally a formal notice from a bishop or ecclesiastical court admonishing a person not to do something specified.
- 6.
The Caveat instance is not the door through which instances communicate, except during policy initiation and subsequent updates. So there is no bottleneck due to the Caveat instance.
- 7.
ACPO - Association of Chief Police Officers UK.
- 8.
The battery monitoring application only needs the topic to access the battery but not the heart rate.
- 9.
For example someone who gave a photocopy for a SIM card would write on the photocopy “For Vodafone SIM Application”.
- 10.
Once configured the packets will be either LWT marked, or not marked, till further notice. However there is no extra overhead in setting the LWT in every packet, as the Gateway has mechanisms to interpret the attributes and not send further packets to the Caveat instance unless a change in policy is detected. The policy information is stored in the Access Control file (a text file) standard to every Mosquitto broker implementation.
- 11.
In the original scheme the protocol assumes that information will only be decrypted in cases when the user is not present; for example a parent can decrypt provided the child is late arriving home.
- 12.
for example for medical research.
- 13.
The use of biometrics in India to transfer government subsidies to the poor discriminates against the aged farmers without recognizable prints.
References
Acquisti, A.: Identity management privacy and price discrimination. In: IEEE Security and Privacy (2007)
Acquisti, A., Varian, H.: Conditioning prices on purchase history, Technical report. University of California Berkeley (2001)
Anderson, R.: Why cryptosystems fail? In: 1st Conference Computer and Communications Security. ACM (1993)
Camenisch, J., Lysyanskaya, A.: An efficient system for non-transferable anonymous credentials with optional anonymity revocation. In: Pfitzmann, B. (ed.) EUROCRYPT 2001. LNCS, pp. 93–118. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-44987-6_7
Camenisch, J., Herreweghen, E.V.: Design and implementation of the idemix anonymous credential system. In: Proceedings of the 9th ACM Conference on Computer and Communications Security, pp. 21–30 (2002)
Chaum, D.: Untraceable electronic mail, return addresses and digital pseudonyms. Commun. ACM 24(2), 84–90 (1981)
Chaum, D.: Security without identification: transaction systems to make big brother obsolete. Commun. ACM 28(10), 1030–1044 (1985)
Chaum, D.: Achieving electronic privacy. Sci. Am. 267, 96–101 (1992)
Chowdhury, P.D., Christianson, B.: More security or less insecurity. In: Christianson, B., Malcolm, J. (eds.) Security Protocols 2010. LNCS, vol. 7061, pp. 115–119. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-45921-8_18
Nuffield Council on Bio Ethics: The Collection, Linking and Use of Data in Biomedical Research and Health Care: Ethical Issues (2015)
Levy, A., Hong, J., Riliskis, L., Levis, P., Winstein, K.: Beetle: flexible communication for bluetooth low energy. In: Mobisys 2016. ACM (2016)
Ryan, M.D.: Making decryption accountable. In: Stajano, F., Anderson, J., Christianson, B., Matyáš, V. (eds.) Security Protocols 2017. LNCS, vol. 10476, pp. 93–98. Springer, Heidelberg (2017). https://doi.org/10.1007/978-3-319-71075-4_11
Stanford-Clark, A., Truong, H.L., Hunkeler, U.: Mqtt-S Űa publish/subscribe protocol for wireless sensor networks. In: 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE 2008) (2008)
Strahilevitz, L.J.: Toward a positive theory of privacy law. Harvard Law Rev. 126 (2013). https://harvardlawreview.org/authors/lior-jacob-strahilevitz/
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG
About this paper
Cite this paper
Chowdhury, P.D., Christianson, B. (2017). Self Attestation of Things. In: Stajano, F., Anderson, J., Christianson, B., Matyáš, V. (eds) Security Protocols XXV. Security Protocols 2017. Lecture Notes in Computer Science(), vol 10476. Springer, Cham. https://doi.org/10.1007/978-3-319-71075-4_9
Download citation
DOI: https://doi.org/10.1007/978-3-319-71075-4_9
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-71074-7
Online ISBN: 978-3-319-71075-4
eBook Packages: Computer ScienceComputer Science (R0)