Privacy through pseudonymity in user-adaptive systems

Abstract

User-adaptive applications cater to the needs of each individual computer user, taking for example users' interests, level of expertise, preferences, perceptual and motoric abilities, and the usage environment into account. Central user modeling servers collect and process the information about users that different user-adaptive systems require to personalize their user interaction.Adaptive systems are generally better able to cater to users the more data their user modeling systems collect and process about them. They therefore gather as much data as possible and "lay them in stock" for possible future usage. Moreover, data collection usually takes place without users' initiative and sometimes even without their awareness, in order not to cause distraction. Both is in conflict with users' privacy concerns that became manifest in numerous recent consumer polls, and with data protection laws and guidelines that call for parsimony, purpose-orientation, and user notification or user consent when personal data are collected and processed.This article discusses security requirements to guarantee privacy in user-adaptive systems and explores ways to keep users anonymous while fully preserving personalized interaction with them. User anonymization in personalized systems goes beyond current models in that not only users must remain anonymous, but also the user modeling system that maintains their personal data. Moreover, users' trust in anonymity can be expected to lead to more extensive and frank interaction, hence to more and better data about the user, and thus to better personalization. A reference model for pseudonymous and secure user modeling is presented that meets many of the proposed requirements.

Privacy Engine for Context-Aware Enterprise Application Services

“…The approaches of collaborative filtering [12] and K-anonymity [13,20,22,23] assume some semantics (e.g., spatial or temporal) on the underlying data to implicitly control the granularity of data exposure. Similarly, approaches such as "faces" [14] or pseudonym [15] focus on implicit specification of user privacy preferences. In contrast, CPE employs an explicit privacy model, where the evaluation algorithm does not understand the semantics or the value of the data.…”

The Role of Identity in Pervasive Computational Trust

“…Privacy is a constant interaction where information flows between parties [Jiang et al, 2002]. Privacy expectations vary [Brunk, 2002, Jiang et al, 2002 and depend on context [Kobsa and Schreck, 2003]. So, privacy policies based on context [Goecks and Mynatt, 2002, Jendricke et al, 2002, Langheinrich, 2002, Lederer et al, 2003 and trust [Seigneur and Jensen, 2004b] can be made closer to the realworld privacy expectations.…”

“…This is why pseudonymity, the level of indirection between trust and the real-world entity, is necessary. Transaction pseudonyms [Kobsa and Schreck, 2003] (i.e., a pseudonym used for only one transaction) and anonymity cannot be effectively used because they do not allow linkability between transactions as required when building trust. There is an inherent conflict between trust and privacy because both depend on knowledge about an entity but in the opposite ways.…”

“…Wagealla et al [Wagealla et al, 2003] use trustworthiness of an information receiver to make the decision on whether private information should be disclosed or not, which is another way to envisage the relation between trust and privacy. Kosba and Schreck [Kobsa and Schreck, 2003] highlighted the fact that reputation systems do not mandatory require explicit link with real world identities. We added that too much evidence can lead to the disclosure of the implicit link [Seigneur and Jensen, 2004b].…”

“…We added that too much evidence can lead to the disclosure of the implicit link [Seigneur and Jensen, 2004b]. Others [Goldberg, 2000, Hes and Borking, 2000, Kobsa and Schreck, 2003] have presented how pseudonyms can be used for privacy protection and shown that different levels of pseudonymity and configurations exist. Their work is valuable to choose the right type of configuration and pseudonymity.…”