Data privacy in the Internet of Things based on anonymization: A review

2.1.1. Composition of the IoT

In [2], the authors describe the IoT as being composed of 6 components: Identification; Detection; Communication; Computing; Services, and Semantics. The definition and purpose of each of these components will be presented:

Identification: the IoT must name and match services with your demand. Many identification methods are available for the IoT, such as electronic product codes (EPC) and ubiquitous codes (uCode). Besides this, the addressing of IoT objects is critical to differentiate between the object ID and its address. Object ID refers to its name as “T1” for a specific temperature sensor, and the object’s address refers to its address within a communications network;

2.1.2. IoT application areas

As stated earlier, [7] classifies the application of the IoT in three domains, which will be detailed below:

Industrial Domain: one can explore the IoT in all industrial activities that involve everything from commercial to financial transactions. Some examples are logistics, manufacturing, process monitoring, the service sector, banks, government monetary authorities, intermediaries, etc. For example:

Smart city domain: the IoT can help increase the environmental sustainability of cities and people’s quality of life, with an emphasis on energy and how to control it efficiently, in addition to seeking smart solutions to enjoy one’s stay. For example:

Health well-being domain: the IoT will play an essential role in developing intelligent services to support and improve people’s health and society’s activities. These services are directed from citizens to communities, allowing them to be involved in the administration and government decisions, allowing people to live independently or maintain their social relationships, or improve health and social welfare. For examples:

[2] states that “IoT offers a great market opportunity for equipment manufacturers, Internet service providers, and application developers”.

2.4.1. Data obfuscation

Obfuscation is a technique used to protect privacy, such as the user’s location. In this technique, the user’s original location is slightly changed to another place. In this way, the person’s original location is hidden from the opponent. Several techniques have been proposed to protect the site’s privacy, namely dispersion techniques, randomization techniques, perturbation techniques, the semantic glare technique, etc., but none of them paid attention to the balance between privacy and utility. The user can obtain a good result from the privacy perspective but cannot efficiently get the necessary service [48].

2.4.2. K-anonymity

K-anonymity is a typical method of preserving privacy, considering the level of anonymity. Before explaining k-anonymity, it is worthwhile to understand the definition of the data table, index, attribute, identifier, and quasi-identifier:

In [46], the concept of k-anonymity proposes that a data release with this property implies that each person’s information cannot be distinguished from at least k − 1 individuals whose information also appears in that data set. According to [46], in the context of k-anonymity problems, a database is a table with n rows and m columns. Each row in the table represents a record related to a specific population member, and entries in the various rows need not be unique. The values in the multiple columns are the values of the attributes associated with the population’s members. There are two conventional methods for obtaining k-anonymity to attribute a certain value to k, being the following:

For [33], k-anonymity is the process of anonymizing records. Therefore, k individuals are indistinguishable from each other. This mechanism protects the record from identity disclosure; and from the lashing out of attacks from a remote position. Thus, Attachment or Identity Disclosure can offer the opportunity for an attacker to disclose the value of a person’s sensitive attributes with known values. This mechanism is prone to some of the frequent attacks. Some examples include homogeneity attack, similarity attack, background knowledge attack, and probabilistic inference attack [33]. The purpose of the original k-anonymity algorithm is to ensure that no individual can be uniquely identified within a group of k people [26].

2.4.3. Generalization and disturbance

Generalization is a technique for replacing attribute values with a broader category. The method includes sampling, global recoding, and local recoding [45]. Disturbance is a technique for disturbing data using multiplicative or additive noise. Randomized processes are also a popular method of disturbance. Such a technique can be completed only by performing a simple operation on the data and has advantages over the required resources [45].

2.4.4. Sliding window

The Sliding Window technique is used to anonymize the most recent data tuples and publish a recently received data flow. There are two main types of Sliding Window: based on time and count. In the Sliding Window based on the count, the round of anonymization is invoked when the size of the Sliding Window reaches a specific limit. On the other hand, in the Sliding Window based on time, anonymity is controlled by the time received from a tuple in the Sliding Window [24].

2.4.5. Mixing

Mixing is a mechanism for randomizing the sequence of a batch of data so that the output remains indistinguishable from the input. The following are two approaches developed by Chaum that use Mixing, which are Mixnet [9] and DCnet [8].

For [9], the Mixnet is a network that consists of a chain of servers, called mixing nodes. Each mixing node receives a batch of encrypted messages, then decrypts or re-encrypts individual messages performs a random permutation, and forwards the batch to the next mixing node. The final output is unlinkable to the input when at least one of the mixing node’s permutations remains secret. Shuffling is the composition of permutations along the chain of the mixing nodes. Shuffling is verifiable if there is a mechanism to prove the correctness of the output sequence. Mixnet relies on the cryptographic-primitives, for example, factorization or computational discrete logarithm problem. Therefore, verifiable Mixnets incur the additional cost of communication and computation [30].

In another work, Chaum [8] intended the DCnet for anonymous communication. DCnet is free of cryptographic-primitives and eliminates the traffic analysis problem. DCnet is primarily designed for honest people. Unfortunately, DCnet suffers from collision and interference attacks [30].

2.4.6. Pseudonyms

Pseudonyms include the mechanism for renaming entities with alternative random identities. A digital pseudonym is a public key used to verify signatures made by the anonymous holder of the corresponding private key. A roster, or list of pseudonyms, is created by an authority that decides which applications for pseudonyms to accept, but is unable to trace the pseudonyms in the completed roster. For example, the applications may be sent to the authority anonymously, by untraceable mail, or they may be provided in some other way [9].

Each application received by the authority contains all the information required for the acceptance decision and a special unaddressed digital letter (whose message is the public key K, the applicant’s proposed pseudonym). In the case of a single mix, these letters are of the form K 1 ( K 1 , K) [9].

According to [48], the things/devices connected in our homes, shopping malls, streets, and recreational spaces continuously send information over the Internet. These recordings and also the recording of all user movements lead us to several privacy concerns. In light of this, these two authors have proposed an Enhanced Semantic Overshadowing Technique (ESOT), which is designed to preserve the privacy of general IoT device locations.

This technique is based on the semantics of the user or device location. Their primary concern is hiding from the opponent’s IoT device localization, which may want to find a real location to violate privacy. In this scenario, the authors, as mentioned earlier, propose to protect the user’s location from the Localization Based Service (LBS), since LBS is not a reliable component. Therefore, Hiding’s use is recommended. Hiding is a technique used to protect the privacy of the user’s location. In this technique, the user’s original location is slightly changed to another location. In this way, the person’s original location is hidden from the opponent. ESOT achieves better performance in terms of site privacy and service utility compared to the Semantic Overshadowing Technique (SOT).

4.1.2. An anonymization protocol for the Internet of Things

In [12] one sees an anonymity protocol explicitly designed for Machine to Machine IoT and Social Internet of Things (SIoT) communications. The proposed anonymity system is based on the Tor routing concept, but unlike Tor, SIoT is completely datagram-oriented, with less protocol and cryptographic overload. Moreover, path selection is made by a package to increase the overall level of anonymity. Two different anonymity path modes are designed to easily support end-to-end and source-to-output node anonymization models.

In [12], one sees an anonymity protocol explicitly designed for Machine to Machine IoT and Social Internet of Things (SIoT) communications. The proposed anonymity system is based on the Tor routing concept, but unlike Tor, SIoT is completely datagram-oriented, with less protocol and cryptographic overload. Moreover, path selection is made by a package to increase the overall level of anonymity. Two different anonymity path modes are designed to support easily end-to-end and source-to-output node anonymization models.

The anonymity protocol has been implemented as a user anonymity datagram layer that expands upon the standard UDP layer (Java DatagramSocket). This implementation allowed for simple and easy integration into any UDP-based application, such as the CoAP clients and servers used. It was only a matter of replacing the standard UDP layer (Java DatagramSocket) with the new anonymity datagram layer.

Still, according to the authors [12], the main scope of this implementation was to validate the design principles and the protocol’s correctness. Nevertheless, 100 (virtual) IoT objects, which were run on two Raspberry Pi devices (50 virtual nodes per single device), were added. That is to say, the evaluation did not use real objects; they were simulated.

4.1.3. Anonymization method based on sparse coding for power usage data

For [16], a method for anonymizing energy demand data is proposed, in which sparse coding is used to solve the three problems that affect the conventional method. The proposed method can anonymize time series data and allows the data to be analyzed at the chosen time. The proposed method was used to anonymize energy use data at the Urban Design Center of Misono (UDCMi). The experimental error rate decreased when compared to the conventional method. The dictionary produced using the proposed method represents the data from the electrical appliance.

Furthermore, [16] reveals three different privacy standards: k-anonymity, l-diversity, and t-closeness. The proposed method by the authors focuses on k-anonymity. This method achieves the following three main objectives: first, the proposed method allows time-series data to be anonymized; the next goal tells us that the error rate (ER) is reduced compared to conventional methods, and finally, usage information acquired in household appliances can be stored in an anonymous environment.

4.1.4. Hardware for accelerating anonymization transparent to network

[45] proposes data anonymization hardware that obtains transparent anonymization of data flows from IoT devices. The architecture is implemented in a field-programmable gate array (FPGA). The proposed hardware is allocated in the intermediate location of a network to capture the packet of IoT devices. The captured packet is anonymized by hardware and forwarded to the next node while the header is modified without influencing its routing. The anonymization process does not affect the communication protocol or packet routing, and the proposed hardware obtains transparent network anonymization, similar to a communication cable. Transparency allows an anonymization function to be installed on all devices, including IoT devices, but without modifying the devices. The proposed mechanism has achieved lower power consumption and higher throughput than software processing. Besides this, through our investigation we confirm that the FPGA has realized the anonymity of transparent packets to the network.

As described by [45], k-anonymity can be adopted. However, in this study, the authors [45] implemented noise nuisance, which is a simple method of anonymization that requires adding pseudo-random numbers to numerical values. The target values to be anonymized were the energy use data recorded by an intelligent meter. The unauthorized use of energy use data violates the privacy of people living in their homes. Therefore, the preservation of the privacy of energy use data is necessary. The format of the energy use data was a matrix of numerical values with the was previously provided noise range. The authors [45] focused on the transparency of the proposed hardware, a simple method of anonymization and data format being employed.

Although the authors [45] stated that the technique could be used on other IoT devices, they only implemented it in two types of devices and a controlled scenario. The evaluation could be broader, using more data and using different connections to see the behaviour.

4.1.5. K-VARP: K-anonymity for varied data flow via partitioning

[35] proposes the K-VARP (K-anonymity for VARied data flow via partitioning) to anonymize numerous data flows. The goal is to anonymize and publish a variety of data flow, minimizing delay and loss of information. The K-VARP algorithm uses partitioning and marginalization methods to anonymize varied data flow in a time-based Slider Window.

The results demonstrate the effectiveness of K-VARP, as it uses R-similarity to identify similar partitions in the merge. In addition, a combination of marginalization and flexible reuse has a significant impact on the anonymity of varying data flow. K-VARP anonymizes varied data flow with 3% to 9% less information loss and 10% to 20% less information loss in PM 2.5, compared to two of the other compared algorithms, utilizing a similar time span for the calculation. The K-VARPś data usability is better than the other two algorithms because our proposed algorithm does not assign missing values, and belated anonymity is impractical.

4.1.6. Learning light-weight edge-deployable privacy models

According to [27], Apache Spark creates an implementable anonymization model at the edge quickly. Once a model is created, the structure allows even users or cutting-edge IoT devices to overshadow their records without significant computational overheads or knowledge of the data in its entirety to reflect the varying characteristics of data over time. The framework also provides a verification function to validate whether an anonymization model meets the desired data privacy restrictions. Therefore, data administrators do not need to continuously calculate the anonymization model for incoming records. They only retrain an anonymization model when a current model does not pass the validation procedure.

Yet in this article, they [27] implement and evaluate the scalable data anonymization structure and lead to the proposed anonymization function’s flexible deployment. According to the authors [27], the structure speeds up the learning process of anonymization rules by applying parallel computing and generates viable models to be implemented in the latest generation devices. The authors [27] also investigated several factors that affect the performance of anonymization, as well as parallelization. The resultś experimental show that the structure is capable of reducing the time to build anonymization models. The evaluations show that the framework learns anonymization models up to 16 times faster than a sequential anonymization approach and still preserves enough information in anonymized data for data-oriented applications.

4.1.7. Mobile sensor data anonymization

[29] proposes a transformation in the sensor data device to be shared for specific applications, such as monitoring selected daily activities, without revealing information that allows user identification. The authors formulated the anonymization problem using a theoretical approach to knowledge and proposed a new multi-objective loss function for in-depth self-coding training. This loss function helps to minimize user identity information and data distortion to preserve the application-specific utility.

According to [29], to remove the user identifiable features included in the data, not only the neural network model feature extractor (encoder) was considered, but also the reconstructor (decoder) was forced to shape the final output independently of each user in the training set. Hence, the trained final model is a generalized model that can be used by a new invisible user. The authors’ proposal ensures that the transformed data is minimally disturbed so that an application can still produce accurate results, for example, for activity recognition. The solution proposed by [29] is essential to ensure the anonymity of participatory detection when individuals contribute data recorded by their devices for health and wellbeing data analysis.

4.1.8. Privacy and utility preserving data clustering for data anonymization and distribution on Hadoop

[33] proposes a cluster-based anonymization algorithm resilient to similarity attacks and probabilistic inference attacks. The anonymized data is distributed in the Hadoop Distributed File System. The algorithm achieves a better compromise between privacy and utility. Performance is measured in terms of accuracy and FMeasure against different classifiers.

In this work, k-anonymity is employed to preserve data privacy in a distributed environment. The authors claim that they proposed a grouping algorithm to achieve k-anonymization and l-diversity resilient to the attack of similarity and probabilistic inference. Later, privacy preserved anonymized datasets are distributed in Hadoop.

According to [33], data owners can securely distribute the data by applying the proposed cluster algorithms to any distributed structure. The sensitive information in the data is protected against link attacks, homogeneity attacks, similarity attacks, and probabilistic inference attacks using the proposed cluster algorithms.

4.1.9. Privacy preservation in the Internet of Things

What is analyzed by [6] is privacy in the IoT based on a case study that proposes mechanisms to improve security and preserve privacy. This analysis also considers the economic advantages related to the use of IoT as a new business opportunity without the disclosure of personal data.

The paper contributes to the user’s privacy field in IoT by presenting an in-depth risk analysis of the threat to privacy and proposes two approaches to preserving privacy. The first is recommendations for user application developers and the IoT. The second employs the use of anonymization techniques to hide recorded data that can be used as a threat to violate privacy.

4.1.10. The framework and algorithm for preserving user trajectory while using location-based services in IoT-cloud systems

The work of [26], focuses mainly on the solution of two problems: (i) preservation of location privacy for a single query; (ii) preservation of trajectory privacy for continuous consultations. They proposes an efficient algorithm based on the k-anonymity technique to protect the privacy of the user path in location-based services. And to better preserve the privacy of the location and reduce the complexity of time, the proposed k-anonymity mechanism is based on Sliding Window. According to the authors [26], the k Sliding Window selects fictitious locations, and the Trajectory Selection Mechanism (TSM) selects false paths. The simulation results show that the algorithm reduces time complexity compared to existing solutions for a single query, and effectively preserves user path privacy for continuous queries.

4.1.11. TMk-anonymity: Perturbation-based data anonymization method for improving effectiveness of secondary use

In [32], a solution to the privacy problems for disclosed data was developed. The authors defined the TMk-anonymity and proposed three different methods of anonymity, (i) the condensation method, (ii) the addition of noise method, and (iii) the addition of condensation and noise method (CoNoA), which combines the two methods.

TMk-anonymity may be more practical from the perspective that it can give different degrees of anonymity to different individuals compared to the conventional k-anonymity. Furthermore, the rootmean-square error (RSME) of the proposed anonymization methods was approximately 0.7% compared to the conventional Pk-anonymization. This process of retaining resources is since the CoNoA method uses the noise addition method, adding noise according to the original data, and the condensation method that allows lower RMSE anonymity of the data when compared to the other methods.

4.1.12. Toward anonymizing IoT data streams via partitioning

[34] present IoT’s anonymity for a new algorithm that published IoT data flow generated from various IoT devices under the k-anonymity privacy model, and to achieve this anonymity, the time-based Slider Window technique was used to manipulate IoT streams by partitioning tufts based on their description. This preliminary operation helped form the cluster faster by locating tuples and supporting partition merging when needed. The proposed algorithm outperformed the conventional approach of anonymizing the modified data flow to anonymize IoT data flow.

The experiment demonstrated that conventional flow anonymity could not be applied directly to IoT streaming data and required significant research and development. According to the authors [34], it would be interesting to investigate new privacy models to group anonymously with missing data.

4.1.13. Data anonymization: A novel optimal k-anonymity algorithm for identical generalization hierarchy data in IoT

In their research, [28] present a novel optimal k-anonymity algorithm for identical generalization hierarchy (IGH) data which is the main data type in the IoT environment. The authors proposed a novel method to provide a globally optimized k-anonymity solution for the IGH datasets. The proposed algorithms determine an optimal solution based on identical generalization hierarchy (IGH) data characteristics by visiting and evaluating only essential nodes of the generalization lattice that satisfy the k-anonymity. Since the k-anonymization problem is of the NP-hard type, it was shown that the algorithm could efficiently find optimal k-anonymity solutions by exploiting special characteristics of the IGH data, i.e., the optimality between nodes at different levels of the generalization lattice. From the experimental results, according to the authors, it is evident that the algorithm is much more efficient than the comparative algorithms, demanding less searching on the given lattice.

According to [28], the key idea of the algorithm is to analyze only necessary nodes, which are those at the lowest level of generalization, found as k-anonymous nodes, in contrast to other algorithms in the literature where one has to examine all nodes. The algorithm first finds the routes from the root node of the generalization lattice, i.e., (000), to the highest-level node using the pre-order traversal method. The k-anonymity determines all nodes in the routes starting from the node at the lowest level. The k-anonymous nodes are to be tagged, and the lowest level found k-anonymous, called k-anonymous level, is set. The algorithm traverses to the other routes and visits only the nodes at the lower-than-k-anonymous level until all nodes in the lower-than-k-anonymous level have been found and tagged.

4.1.14. Cooperative privacy-preserving data collection protocol based on delocalized-record chains

The authors [40] introduce a novel mechanism of collaborative anonymous communication aimed at multi-user environments, named delocalized-record chain. The proposal is characterized by being an autonomous solution adapted to the distributed nature of an IoT environment, in which the users interested in getting anonymity work in synergy to anonymize their data transmissions. Because the solution lacks third-party intermediaries, it is particularly appropriate for private networks, such as private IoT networks.

The new data collection generates a protocol by the name of Cooperative Privacy-Preserving Data Collection protocol (cPPDC) that offers privacy-preserving conditions in both data collection and publication without limiting Privacy-Preserving Data Collection (PPDC). This method can be used to k-anonymize the data set. This protocol is resistant to network traffic analysis attacks by using the delocalized-record chain as a data transmission medium in the collection phase. This protocol can generate k-anonymous datasets in IoT environments, protecting, at its source, the personal data that a set of devices sends to a central collector. To extend the privacy requirement to the data collection phase, the protocol uses a new mechanism of collaborative anonymous communication named delocalized-record chain. Since the protocol does not require third-party anonymous communication channels, its application is especially relevant in IoT environments deployed on private networks [40].

4.1.15. Data anonymization for privacy protection in fog enhanced smart homes

This paper [38] presents the architecture of a fog-enhanced smart home environment for preserving the privacy of individuals when data from their smart homes is shared with third parties. A Km data anonymization technique is employed to prevent privacy breaches by individuals. The proposed architecture and technique are evaluated on a real-world data set, and the results indicate their effectiveness in the preservation of privacy.

In the proposed architecture for [38], the privacy preservation module (PPM) is placed on the fog layer. The sensitive data collected from smart homes in a community or smart apartment complex is fed to the PPM. The PPM applies a slicing technique [25] to the aggregated data. It removes the linkage between the constituent fields of user records. This remotion anonymizes the data, and consequently, it is not possible to associate a data record with a particular user or home. This impossibility protects the user data from privacy breaches.

4.1.16. A robust privacy preserving approach for electronic health records using multiple dataset with multiple sensitive attributes

[20] formalized an adversary’s behaviour, performing identity and attribute disclosures on a balanced p+-sensitive k-anonymity model with the help of adversarial scenarios, since the balanced p+-sensitive k-anonymity model is not sufficient for 1 to M with multiple sensitive attributes (MSAs) 1 datasets in terms of privacy preservation. The authors coined an extended privacy model called “1: M MSA-(p, l)-diversity” for 1: M dataset with MSAs.

They then performed formal modelling and verification of the proposed model using High-Level Petri Nets (HLPN) to confirm privacy attack invalidation. Experimental results show that the proposed “1: MMSA-(p, l)-diversity model” is efficient and provides enhanced data utility of published data [20].

[20] proposes an approach based on datasets containing MSAs and multiple records of a single patient (1: M) in EHRs. It is done to classify the privacy scenarios for identity and sensitive attribute disclosure on a balanced p+ sensitive k-anonymity model and proposed an improved version called “1: M MSA-(p, l)-diversity” to anonymize EHRs data.

4.1.17. Distributed l-diversity using Spark-based algorithm for large resource description frameworks data

In this work, [18] proposes an l-diversity anatomy de-identification method that can overcome the limitations of k-anonymity and guarantee stronger privacy protection than k-anonymization. Further, as this data anonymization process is computationally time-intensive, Spark distributed computing to provide rapid re-identification to enhance its utility. Preservation of l-diversity was also proposed for dynamically evolving RDF datasets. Experimental results show that the proposed distribution of the l-diversity algorithm processes the data more efficiently than conventional approaches.