Detecting inference attacks involving sensor data

Sharing and processing personal information with organizations has become increasingly essential for social interaction. In Europe, under the GDPR (General Data Protection Regulation), they must protect the data they collect by design and by default. Access Control (AC) mechanisms have traditionally been used to secure information systems against unauthorized access to sensitive data. However, the increasing availability of sensor data is motivating new services to provide information about individuals. Various data mining algorithms have been proposed to infer new personal data from sensor data. Sensitive data can be accessed indirectly using non-sensitive data, such as information inferred from sensor data. Therefore, there is a risk of bypassing AC mechanisms to obtain information using sensor data. We propose an inference detection system based on the analysis of queries issued on a sensor database. The knowledge obtained via these queries, and the inference channels corresponding to the use of data mining algorithms on sensor data to infer information from individuals, are described using the Raw sensor data based Inference ChannEl Model (RICE-M). Detection is performed by the RICE-M based inference detection System (RICE-Sy). RICE-Sy considers, at the time of the query, the knowledge that a user obtains via a new query and has obtained via its query history, and determines whether this is sufficient to allow this user to exploit a channel. In this way, privacy protection systems can take advantage of the inferences detected by RICE-Sy, by taking into account the information about individuals obtained by attackers via a sensor database, to further protect the data collected.