A privacy scoring framework: Automation of privacy compliance and risk evaluation with standard indicators

Kim, Nakyoung; Oh, Hyeontaek; Choi, Jun Kyun

doi:10.1016/j.jksuci.2022.12.019

Cited by 2 publications

(4 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In particular, the Android platform facilitates first-and third-party applications with application programming interfaces (API) that allow the applications to access information and resources of the system and device hardware (Almomani, 2020). This resulted in increasing the risk of leakage of users' personal information (Kim & Oh & Choi, 2023) and mobile malware attacks (Ashawa & Morris, 2020). Research has shown that the openness of the Android system and the popularity of Android mobile devices have driven the fast development of Android applications, whilst this also led to an increase in personal data leakage (Guaman et al, 2021).…”

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…Several studies have analysed the privacy risk posed by Android applications (Hamed & Ayed, 2016), (Kim & Oh & Choi, 2023), (Gamba, 2019). The authors Kim & Oh & Choi (2023) have identified privacy indicators and based on them, introduced a model to calculate a privacy score for an Android application. However, the model requires various criteria to evaluate and quantify the objective information i.e., ability, benevolence, and integrity of personal data, and subjective indicators in the interaction between the service and its users, i.e., experience, reputation, and inclination.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Hidden Permissions on Android: A Permission-Based Android Mobile Privacy Risk Model

Yılmaz

Davis

2023

eccws

View full text Add to dashboard Cite

The continuously increasing amount of data input on mobile devices has made collating and monitoring users’ data not only uniquely personalised but easier than ever. Along with that, mobile security threats have overtaken with rising numbers in bank fraud and personal information leaks. This suggests that there is a significant lack of awareness of security issues among mobile users. Specifically, permission-based passive content leaks are getting more attention due to the emerging issues in data privacy. One reason for this is that permissions are running in the background collecting and transmitting data between applications within the same permission group, without the user's knowledge. This means, that a supposedly innocent application like the Clock, which is linked with the Calendar to provide the date and time functionality, can have access to any other application within the same Calendar permission group, which is compromising confidentiality. Moreover, this can lead to a violation of data privacy as the user is not aware of which assets are being shared between permissions. Developers of mobile platforms have implemented permission-based models to counteract these issues, however, application designers have shown that they are not necessarily complying with the General Data Protection Regulations (GDPR). For the mobile user, this means that app developers, app providers, and third parties who are included in the applications, can gain access to sensitive data without user consent or awareness. To address this issue, this study examines permissions that are inherent in the Android mobile infrastructure and exemplifies how they can reveal delicate user information, identify user behaviour, and can be shared among other applications - without obviously breaching GDPR guidelines. 10 first-party Android applications were statically analysed by their permissions and manually investigated for their actual purpose and privacy risk. Finally, considering the affected area, these permissions were categorised into four asset groups that form the base of a risk model. With risk levels from low to high, this model provides detection of risks on data privacy in mobile permissions and highlights the difficulty with GDPR compliance, which we therefore named PRAM, a permission-based Android Mobile Privacy Risk Assessment Model.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Hidden Permissions on Android: A Permission-Based Android Mobile Privacy Risk Model

Yılmaz

Davis

2023

eccws

View full text Add to dashboard Cite

show abstract

“…Figure 1 (inspired by [10], [11]) shows a general sequence of a consent-based privacy-compliant personal data utilization among the actors. The company, which is responsible for providing a service to data subjects, acts as a data controller (usually acts as a data processor, too) and obtains personal data with necessary consent from the data subjects (or data providers).…”

mentioning

confidence: 99%

A Consent-Based Privacy-Compliant Personal Data-Sharing System

Park,

Oh,

Choi

2023

IEEE Access

Self Cite

View full text Add to dashboard Cite

Personal data is becoming increasingly valuable in business, as the insights that can be obtained from data processing continue to improve. However, it also can cause adverse effects on individuals. To improve data quality while satisfying privacy compliance, companies now have focused on collecting informed consent from individuals to directly handle personal data without applying any privacy-preserving techniques. Even though the companies obtain consent to use personal data, to improve transparency and accountability to ensure that companies deal with personal data according to consent, it is necessary for a system to comply with privacy requirements. Therefore, this paper proposes a new consent-based privacy-compliant personal data-sharing system that considers personal data-sharing flows and requirements obtained from enterprises and privacy frameworks, respectively. By analyzing a general process and the roles of actors for data sharing in enterprise environments according to standard privacy frameworks, this paper has proposed system requirements, system architecture, and detailed procedure for a consent-based privacycompliant processing method that considers compliance checking as well as consent checking. To show the feasibility of the proposed system, this paper demonstrates a prototype and the performance analysis in the lab and real-world environments.

show abstract

A privacy scoring framework: Automation of privacy compliance and risk evaluation with standard indicators

Cited by 2 publications

References 17 publications

Hidden Permissions on Android: A Permission-Based Android Mobile Privacy Risk Model

Hidden Permissions on Android: A Permission-Based Android Mobile Privacy Risk Model

A Consent-Based Privacy-Compliant Personal Data-Sharing System

Contact Info

Product

Resources

About