Privacy-aware Security Applications in the Era of Internet of Things

Authors

Abbas Acar, Florida International UniversityFollow

Document Type

Dissertation

Degree

Doctor of Philosophy (PhD)

Major/Program

Electrical Engineering

First Advisor's Name

A. Selcuk Uluagac

First Advisor's Committee Title

Committee Chair

Second Advisor's Name

Kemal Akkaya

Second Advisor's Committee Title

Committee Member

Third Advisor's Name

Alexander Perez-Pons

Third Advisor's Committee Title

Committee Member

Fourth Advisor's Name

Bogdan Carbunar

Fourth Advisor's Committee Title

Committee Member

Keywords

Privacy, Security, IoT, Authentication, Homomorphic Encryption

Date of Defense

4-16-2020

Abstract

In this dissertation, we introduce several novel privacy-aware security applications. We split these contributions into three main categories: First, to strengthen the current authentication mechanisms, we designed two novel privacy-aware alternative complementary authentication mechanisms, Continuous Authentication (CA) and Multi-factor Authentication (MFA). Our first system is Wearable-assisted Continuous Authentication (WACA), where we used the sensor data collected from a wrist-worn device to authenticate users continuously. Then, we improved WACA by integrating a noise-tolerant template matching technique called NTT-Sec to make it privacy-aware as the collected data can be sensitive. We also designed a novel, lightweight, Privacy-aware Continuous Authentication (PACA) protocol. PACA is easily applicable to other biometric authentication mechanisms when feature vectors are represented as fixed-length real-valued vectors. In addition to CA, we also introduced a privacy-aware multi-factor authentication method, called PINTA. In PINTA, we used fuzzy hashing and homomorphic encryption mechanisms to protect the users' sensitive profiles while providing privacy-preserving authentication. For the second privacy-aware contribution, we designed a multi-stage privacy attack to smart home users using the wireless network traffic generated during the communication of the devices. The attack works even on the encrypted data as it is only using the metadata of the network traffic. Moreover, we also designed a novel solution based on the generation of spoofed traffic. Finally, we introduced two privacy-aware secure data exchange mechanisms, which allow sharing the data between multiple parties (e.g., companies, hospitals) while preserving the privacy of the individual in the dataset. These mechanisms were realized with the combination of Secure Multiparty Computation (SMC) and Differential Privacy (DP) techniques. In addition, we designed a policy language, called Curie Policy Language (CPL), to handle the conflicting relationships among parties.

The novel methods, attacks, and countermeasures in this dissertation were verified with theoretical analysis and extensive experiments with real devices and users. We believe that the research in this dissertation has far-reaching implications on privacy-aware alternative complementary authentication methods, smart home user privacy research, as well as the privacy-aware and secure data exchange methods.

Identifier

FIDC008988

ORCID

https://orcid.org/0000-0002-4891-160X/

Recommended Citation

Acar, Abbas, "Privacy-aware Security Applications in the Era of Internet of Things" (2020). FIU Electronic Theses and Dissertations. 4532.
https://digitalcommons.fiu.edu/etd/4532