skip to main content
research-article
Public Access

PrivacyStreams: Enabling Transparency in Personal Data Processing for Mobile Apps

Published: 11 September 2017 Publication History

Abstract

Smartphone app developers often access and use privacy-sensitive data to create apps with rich and meaningful interactions. However, it can be challenging for auditors and end-users to know what granularity of data is being used and how, thereby hindering assessment of potential risks. Furthermore, developers lack easy ways of offering transparency to users regarding how personal data is processed, even if their intentions are to make their apps more privacy friendly. To address these challenges, we introduce PrivacyStreams, a functional programming model for accessing and processing personal data as a stream. PrivacyStreams is designed to make it easy for developers to make use of personal data while simultaneously making it easier to analyze how that personal data is processed and what granularity of data is actually used. We present the design and implementation of PrivacyStreams, as well as several user studies and experiments to demonstrate its usability, utility, and support for privacy.

References

[1]
Yuvraj Agarwal and Malcolm Hall. 2013. ProtectMyPrivacy: Detecting and Mitigating Privacy Leaks on iOS Devices Using Crowdsourcing. In Proceeding of the 11th Annual International Conference on Mobile Systems, Applications, and Services (MobiSys ’13). ACM, New York, NY, USA, 97--110.
[2]
Nadav Aharony, Alan Gardner, and Cody Sumter. 2011. Funf open sensing framework. (2011). Retrieved July 1, 2017 from http://funf.org/
[3]
Steven Arzt, Siegfried Rasthofer, Christian Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves Le Traon, Damien Octeau, and Patrick McDaniel. 2014. FlowDroid: Precise Context, Flow, Field, Object-sensitive and Lifecycle-aware Taint Analysis for Android Apps. In Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’14). ACM, New York, NY, USA, 259--269.
[4]
Daniel Avrahami and Scott E. Hudson. 2006. Responsiveness in Instant Messaging: Predictive Models Supporting Inter-personal Communication. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ’06). ACM, New York, NY, USA, 731--740.
[5]
Rebecca Balebako, Abigail Marsh, Jialiu Lin, Jason I Hong, and Lorrie Faith Cranor. 2014. The privacy and security behaviors of smartphone app developers. In Proceedings of Workshop on Usable Security.
[6]
Louise Barkhuus, Barry Brown, Marek Bell, Scott Sherwood, Malcolm Hall, and Matthew Chalmers. 2008. From Awareness to Repartee: Sharing Location Within Social Groups. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ’08). ACM, New York, NY, USA, 497--506.
[7]
Joshua Bloch. 2006. How to Design a Good API and Why It Matters. In Companion to the 21st ACM SIGPLAN Symposium on Object-oriented Programming Systems, Languages, and Applications (OOPSLA ’06). ACM, New York, NY, USA, 506--507.
[8]
Don Box and Anders Hejlsberg. 2007. LINQ: .NET Language-Integrated Query. (2007). Retrieved July 1, 2017 from https://msdn.microsoft.com/en-us/library/bb308959.aspx
[9]
Zhenyu Chen, Mu Lin, Fanglin Chen, Nicholas D. Lane, Giuseppe Cardone, Rui Wang, Tianxing Li, Yiqiang Chen, Tanzeem Choudhury, and Andrew T. Campbell. 2013. Unobtrusive Sleep Monitoring Using Smartphones. In Proceedings of the 7th International Conference on Pervasive Computing Technologies for Healthcare (PervasiveHealth ’13). 145--152.
[10]
Yohan Chon, Nicholas D. Lane, Fan Li, Hojung Cha, and Feng Zhao. 2012. Automatically Characterizing Places with Opportunistic Crowdsensing Using Smartphones. In Proceedings of the 2012 ACM Conference on Ubiquitous Computing (UbiComp ’12). ACM, New York, NY, USA, 481--490.
[11]
Sauvik Das, Jason Wiese, and Jason I. Hong. 2016. Epistenet: Facilitating Programmatic Access 8 Processing of Semantically Related Mobile Personal Data. In Proceedings of the 18th International Conference on Human-Computer Interaction with Mobile Devices and Services (MobileHCI ’16). ACM, New York, NY, USA, 244--253.
[12]
Drew Davidson, Matt Fredrikson, and Benjamin Livshits. 2014. MoRePriv: Mobile OS Support for Application Personalization and Privacy. In Proceedings of the 30th Annual Computer Security Applications Conference (ACSAC ’14). ACM, New York, NY, USA, 236--245.
[13]
Yves-Alexandre de Montjoye, Erez Shmueli, Samuel S. Wang, and Alex Sandy Pentland. 2014. openPDS: Protecting the Privacy of Metadata through SafeAnswers. PLOS ONE 9, 7 (July 2014), 1--9.
[14]
Jens Dittrich and Jorge-Arnulfo Quiané-Ruiz. 2012. Efficient Big Data Processing in Hadoop MapReduce. Proc. VLDB Endow. 5, 12 (Aug. 2012), 2014--2015.
[15]
Afsaneh Doryab, Jun-Ki Min, Jason Wiese, John Zimmerman, and Jason I Hong. 2014. Detection of Behavior Change in People with Depression. In AAAI Workshop: Modern Artificial Intelligence for Health Analytics.
[16]
William Enck, Peter Gilbert, Byung-Gon Chun, Landon P. Cox, Jaeyeon Jung, Patrick McDaniel, and Anmol N. Sheth. 2010. TaintDroid: An Information-flow Tracking System for Realtime Privacy Monitoring on Smartphones. In Proceedings of the 9th USENIX Conference on Operating Systems Design and Implementation (OSDI’10). USENIX Association, Berkeley, CA, USA, 393--407. http://dl.acm.org/citation.cfm?id=1924943.1924971
[17]
Michael D. Ernst, René Just, Suzanne Millstein, Werner Dietl, Stuart Pernsteiner, Franziska Roesner, Karl Koscher, Paulo Barros Barros, Ravi Bhoraskar, Seungyeop Han, Paul Vines, and Edward X. Wu. 2014. Collaborative Verification of Information Flow for a High-Assurance App Store. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security (CCS ’14). ACM, New York, NY, USA, 1092--1104.
[18]
Deborah Estrin. 2014. Small Data, Where N = Me. Commun. ACM 57, 4 (April 2014), 32--34.
[19]
Denzil Ferreira, Vassilis Kostakos, and Anind K Dey. 2015. AWARE: mobile context instrumentation framework. Frontiers in ICT 2 (2015), 6.
[20]
Matthew Fredrikson and Benjamin Livshits. 2011. RePriv: Re-imagining Content Personalization and In-browser Privacy. In Proceedings of the 2011 IEEE Symposium on Security and Privacy (SP ’11). IEEE Computer Society, Washington, DC, USA, 131--146.
[21]
Stylianos Gisdakis, Thanassis Giannetsos, and Panos Papadimitratos. 2016. Android Privacy C(R)Ache: Reading Your External Storage and Sensors for Fun and Profit. In Proceedings of the 1st ACM Workshop on Privacy-Aware Mobile Computing (PAMCO ’16). ACM, New York, NY, USA, 1--10.
[22]
Michael I Gordon, Deokhwan Kim, Jeff H Perkins, Limei Gilham, Nguyen Nguyen, and Martin C Rinard. 2015. Information Flow Analysis of Android Applications in DroidSafe. In NDSS. Citeseer.
[23]
Jianjun Huang, Xiangyu Zhang, Lin Tan, Peng Wang, and Bin Liang. 2014. AsDroid: Detecting Stealthy Behaviors in Android Applications by User Interface and Program Behavior Contradiction. In Proceedings of the 36th International Conference on Software Engineering (ICSE 2014). ACM, New York, NY, USA, 1036--1046.
[24]
Shubham Jain and Janne Lindqvist. 2014. Should I protect you? Understanding developers’ behavior to privacy-preserving APIs. In Workshop on Usable Security.
[25]
Younghee Jung, Per Persson, and Jan Blom. 2005. DeDe: Design and Evaluation of a Context-enhanced Mobile Messaging System. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ’05). ACM, New York, NY, USA, 351--360.
[26]
Aman Kansal, Scott Saponas, A.J. Bernheim Brush, Kathryn S. McKinley, Todd Mytkowicz, and Ryder Ziola. 2013. The Latency, Accuracy, and Battery (LAB) Abstraction: Programmer Productivity and Energy Efficiency for Continuous Mobile Context Sensing. In Proceedings of the 2013 ACM SIGPLAN International Conference on Object Oriented Programming Systems Languages 8 Applications (OOPSLA ’13). ACM, New York, NY, USA, 661--676.
[27]
Joon-Gyum Kim, Chia-Wei Wu, Alvin Chiang, JeongGil Ko, and Sung-Ju Lee. 2016. A Picture is Worth a Thousand Words: Improving Mobile Messaging with Real-time Autonomous Image Suggestion. In Proceedings of the 17th International Workshop on Mobile Computing Systems and Applications (HotMobile ‘16). ACM, New York, NY, USA, 51--56.
[28]
Yuanchun Li, Yao Guo, and Xiangqun Chen. 2016. PERUIM: Understanding Mobile Application Privacy with permission-UI Mapping. In Proceedings of the 2016 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp ’16). ACM, New York, NY, USA, 682--693.
[29]
Yuanchun Li, Yao Guo, Junjun Kong, and Xiangqun Chen. 2015. Fixing sensor-related energy bugs through automated sensing policy instrumentation. In 2015 IEEE/ACM International Symposium on Low Power Electronics and Design (ISLPED). 321--326.
[30]
Yuanchun Li, Ziyue Yang, Yao Guo, and Xiangqun Chen. 2017. DroidBot: A Lightweight UI-guided Test Input Generator for Android. In Proceedings of the 39th International Conference on Software Engineering Companion (ICSE-C ’17). IEEE Press, Piscataway, NJ, USA, 23--26.
[31]
Robert LiKamWa, Yunxin Liu, Nicholas D. Lane, and Lin Zhong. 2013. MoodScope: Building a Mood Sensor from Smartphone Usage Patterns. In Proceeding of the 11th Annual International Conference on Mobile Systems, Applications, and Services (MobiSys ’13). ACM, New York, NY, USA, 389--402.
[32]
Jialiu Lin, Shahriyar Amini, JasonI. Hong, Norman Sadeh, Janne Lindqvist, and Joy Zhang. 2012. Expectation and Purpose: Understanding Users’ Mental Models of Mobile App Privacy Through Crowdsourcing. In Proceedings of the 2012 ACM Conference on Ubiquitous Computing (UbiComp ’12). ACM, New York, NY, USA, 501--510.
[33]
Xuan Lu, Wei Ai, Xuanzhe Liu, Qian Li, Ning Wang, Gang Huang, and Qiaozhu Mei. 2016. Learning from the Ubiquitous Language: An Empirical Analysis of Emoji Usage of Smartphone Users. In Proceedings of the 2016 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp ‘16). ACM, New York, NY, USA, 770--780.
[34]
Chulhong Min, Seungchul Lee, Changhun Lee, Youngki Lee, Seungwoo Kang, Seungpyo Choi, Wonjung Kim, and Junehwa Song. 2016. PADA: Power-aware Development Assistant for Mobile Sensing Applications. In Proceedings of the 2016 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp ’16). ACM, New York, NY, USA, 946--957.
[35]
Jun-Ki Min, Afsaneh Doryab, Jason Wiese, Shahriyar Amini, John Zimmerman, and Jason I. Hong. 2014. Toss ’N’ Turn: Smartphone As Sleep and Sleep Quality Detector. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ’14). 477--486.
[36]
Jun-Ki Min, Jason Wiese, Jason I. Hong, and John Zimmerman. 2013. Mining Smartphone Data to Classify Life-facets of Social Relationships. In Proceedings of the 2013 Conference on Computer Supported Cooperative Work (CSCW ’13). ACM, New York, NY, USA, 285--294.
[37]
Rahul Pandita, Xusheng Xiao, Wei Yang, William Enck, and Tao Xie. 2013. WHYPER: Towards Automating Risk Assessment of Mobile Applications. In USENIX Security Symposium. Washington, D.C., 527--542.
[38]
Martin Pielot, Tilman Dingler, Jose San Pedro, and Nuria Oliver. 2015. When Attention is Not Scarce - Detecting Boredom from Mobile Phone Usage. In Proceedings of the 2015 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp ’15). 825--836.
[39]
PrivacyStreams. 2016. PrivacyStreams API documentation. (2016). Retrieved July 1, 2017 from https://privacystreams.github.io/
[40]
Zhengyang Qu, Vaibhav Rastogi, Xinyi Zhang, Yan Chen, Tiantian Zhu, and Zhong Chen. 2014. AutoCog: Measuring the Description-to-permission Fidelity in Android Applications. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security (CCS ’14). ACM, New York, NY, USA, 1354--1365.
[41]
ReactiveX. 2017. An API for asynchronous programming with observable streams. (2017). Retrieved July 1, 2017 from http://reactivex.io/
[42]
L. Ruge, B. Altakrouri, and A. Schrader. 2013. SoundOfTheCity - Continuous noise monitoring for a healthy city. In 2013 IEEE International Conference on Pervasive Computing and Communications Workshops. 670--675.
[43]
Daniel Salber, Anind K. Dey, and Gregory D. Abowd. 1999. The Context Toolkit: Aiding the Development of Context-enabled Applications. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (CHI ’99). ACM, New York, NY, USA, 434--441.
[44]
Rocky Slavin, Xiaoyin Wang, Mitra Bokaei Hosseini, James Hester, Ram Krishnan, Jaspreet Bhatia, Travis D. Breaux, and Jianwei Niu. 2016. Toward a Framework for Detecting Privacy Policy Violations in Android Application Code. In Proceedings of the 38th International Conference on Software Engineering (ICSE ’16). ACM, New York, NY, USA, 25--36.
[45]
Jacopo Staiano, Nuria Oliver, Bruno Lepri, Rodrigo de Oliveira, Michele Caraviello, and Nicu Sebe. 2014. Money Walks: A Human-centric Study on the Economics of Personal Mobile Data. In Proceedings of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp ’14). ACM, New York, NY, USA, 583--594.
[46]
Mingshen Sun, Tao Wei, and John C.S. Lui. 2016. TaintART: A Practical Multi-level Information-Flow Tracking System for Android RunTime. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS ’16). ACM, New York, NY, USA, 331--342.
[47]
Raoul-Gabriel Urma. 2014. Processing Data with Java SE 8 Streams. (2014). Retrieved July 1, 2017 from http://www.oracle.com/technetwork/articles/java/ma14-java-se- 8-streams-2177646.html
[48]
Raja Vallée-Rai, Phong Co, Etienne Gagnon, Laurie Hendren, Patrick Lam, and Vijay Sundaresan. 1999. Soot - a Java Bytecode Optimization Framework. In Proceedings of the 1999 Conference of the Centre for Advanced Studies on Collaborative Research (CASCON ’99). IBM Press. http://dl.acm.org/citation.cfm?id=781995.782008
[49]
Emanuel von Zezschwitz, Sigrid Ebbinghaus, Heinrich Hussmann, and Alexander De Luca. 2016. You Can’t Watch This!: Privacy-Respectful Photo Browsing on Smartphones. In Proceedings of the 2016 CHI Conference on Human Factors in Computing Systems. ACM, 4320--4324.
[50]
Dashun Wang, Dino Pedreschi, Chaoming Song, Fosca Giannotti, and Albert-Laszlo Barabasi. 2011. Human Mobility, Social Ties, and Link Prediction. In Proceedings of the 17th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD ’11). ACM, New York, NY, USA, 1100--1108.
[51]
Haoyu Wang, Jason Hong, and Yao Guo. 2015. Using Text Mining to Infer the Purpose of Permission Use in Mobile Apps. In Proceedings of the 2015 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp ’15). ACM, New York, NY, USA, 1107--1118.
[52]
Rui Wang, Fanglin Chen, Zhenyu Chen, Tianxing Li, Gabriella Harari, Stefanie Tignor, Xia Zhou, Dror Ben-Zeev, and Andrew T. Campbell. 2014. StudentLife: Assessing Mental Health, Academic Performance and Behavioral Trends of College Students Using Smartphones. In Proceedings of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp ’14). ACM, New York, NY, USA, 3--14.
[53]
Rui Wang, Gabriella Harari, Peilin Hao, Xia Zhou, and Andrew T. Campbell. 2015. SmartGPA: How Smartphones Can Assess and Predict Academic Performance of College Students. In Proceedings of the 2015 ACM International Joint Conference on Pervasive and Ubiquitous Computing (UbiComp ‘15). ACM, New York, NY, USA, 295--306.
[54]
Primal Wijesekera, Arjun Baokar, Ashkan Hosseini, Serge Egelman, David Wagner, and Konstantin Beznosov. 2015. Android Permissions Remystified: A Field Study on Contextual Integrity. In USENIX Security, Vol. 15.
[55]
Jean Yang, Kuat Yessenov, and Armando Solar-Lezama. 2012. A Language for Automatically Enforcing Privacy Policies. In Proceedings of the 39th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL ’12). ACM, New York, NY, USA, 85--96.
[56]
Zhemin Yang, Min Yang, Yuan Zhang, Guofei Gu, Peng Ning, and X. Sean Wang. 2013. AppIntent: Analyzing Sensitive Data Transmission in Android for Privacy Leakage Detection. In Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security (CCS ’13). ACM, New York, NY, USA, 1043--1054.
[57]
Matei Zaharia, Tathagata Das, Haoyuan Li, Timothy Hunter, Scott Shenker, and Ion Stoica. 2013. Discretized Streams: Fault-tolerant Streaming Computation at Scale. In Proceedings of the Twenty-Fourth ACM Symposium on Operating Systems Principles (SOSP ’13). ACM, New York, NY, USA, 423--438.
[58]
Yajin Zhou and Xuxian Jiang. 2012. Dissecting android malware: Characterization and evolution. In 2012 IEEE Symposium on Security and Privacy (S8P ’12). IEEE, 95--109.

Cited By

View all
  • (2024)Water Level Recognition by Analyzing the Sound when Pouring WaterCompanion of the 2024 on ACM International Joint Conference on Pervasive and Ubiquitous Computing10.1145/3675094.3678440(464-469)Online publication date: 5-Oct-2024
  • (2024)ChainStream: A Stream-based LLM Agent Framework for Continuous Context Sensing and SharingProceedings of the Workshop on Edge and Mobile Foundation Models10.1145/3662006.3662063(18-23)Online publication date: 3-Jun-2024
  • (2024)Talk2Care: An LLM-based Voice Assistant for Communication between Healthcare Providers and Older AdultsProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies10.1145/36596258:2(1-35)Online publication date: 15-May-2024
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies
Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies  Volume 1, Issue 3
September 2017
2023 pages
EISSN:2474-9567
DOI:10.1145/3139486
Issue’s Table of Contents
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 11 September 2017
Accepted: 01 July 2017
Received: 01 May 2017
Published in IMWUT Volume 1, Issue 3

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. Personal data
  2. data granularity
  3. functional programming
  4. mobile apps
  5. transparency

Qualifiers

  • Research-article
  • Research
  • Refereed

Funding Sources

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)479
  • Downloads (Last 6 weeks)60
Reflects downloads up to 27 Feb 2025

Other Metrics

Citations

Cited By

View all
  • (2024)Water Level Recognition by Analyzing the Sound when Pouring WaterCompanion of the 2024 on ACM International Joint Conference on Pervasive and Ubiquitous Computing10.1145/3675094.3678440(464-469)Online publication date: 5-Oct-2024
  • (2024)ChainStream: A Stream-based LLM Agent Framework for Continuous Context Sensing and SharingProceedings of the Workshop on Edge and Mobile Foundation Models10.1145/3662006.3662063(18-23)Online publication date: 3-Jun-2024
  • (2024)Talk2Care: An LLM-based Voice Assistant for Communication between Healthcare Providers and Older AdultsProceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies10.1145/36596258:2(1-35)Online publication date: 15-May-2024
  • (2024)Privacy of Default Apps in Apple’s Mobile EcosystemProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642831(1-32)Online publication date: 11-May-2024
  • (2024)An Empathy-Based Sandbox Approach to Bridge the Privacy Gap among Attitudes, Goals, Knowledge, and BehaviorsProceedings of the 2024 CHI Conference on Human Factors in Computing Systems10.1145/3613904.3642363(1-28)Online publication date: 11-May-2024
  • (2023)APIMind: API-driven Assessment of Runtime Description-to-permission Fidelity in Android Apps2023 IEEE 34th International Symposium on Software Reliability Engineering (ISSRE)10.1109/ISSRE59848.2023.00057(427-438)Online publication date: 9-Oct-2023
  • (2023)Fine-Grained In-Context Permission Classification for Android Apps Using Control-Flow Graph Embedding2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE)10.1109/ASE56229.2023.00056(1225-1237)Online publication date: 11-Sep-2023
  • (2023)Understanding behaviours in context using mobile sensingNature Reviews Psychology10.1038/s44159-023-00235-32:12(767-779)Online publication date: 23-Oct-2023
  • (2022)A comparative study on surveillance and privacy regulations (the UAE vs. the USA and the EU)Journal of Governance and Regulation10.22495/jgrv11i1art211:1(20-26)Online publication date: 5-Jan-2022
  • (2022)Right to Know, Right to Refuse: Towards UI Perception-Based Automated Fine-Grained Permission Controls for Android AppsProceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering10.1145/3551349.3559556(1-6)Online publication date: 10-Oct-2022
  • Show More Cited By

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Login options

Full Access

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media