skip to main content
research-article
Public Access

Quantifying the Utility--Privacy Tradeoff in the Internet of Things

Published: 23 May 2018 Publication History

Abstract

The Internet of Things (IoT) promises many advantages in the control and monitoring of physical systems from both efficacy and efficiency perspectives. However, in the wrong hands, the data might pose a privacy threat. In this article, we consider the tradeoff between the operational value of data collected in the IoT and the privacy of consumers. We present a general framework for quantifying this tradeoff in the IoT, and focus on a smart grid application for a proof of concept. In particular, we analyze the tradeoff between smart grid operations and how often data are collected by considering a realistic direct-load control example using thermostatically controlled loads, and we give simulation results to show how its performance degrades as the sampling frequency decreases. Additionally, we introduce a new privacy metric, which we call inferential privacy. This privacy metric assumes a strong adversary model and provides an upper bound on the adversary’s ability to infer a private parameter, independent of the algorithm he uses. Combining these two results allows us to directly consider the tradeoff between better operational performance and consumer privacy.

References

[1]
Alessandro Acquisti, Laura Brandimarte, and George Loewenstein. 2015. Privacy and human behavior in the age of information. Science 347, 6221 (2015), 509--514. arXiv:http://science.sciencemag.org/content/347/6221/509.full.pdf
[2]
Gergely Acs and Claude Castelluccia. 2011. I have a DREAM! (DiffeRentially privatE smArt metering). In Information Hiding. Lecture Notes in Computer Science, Vol. 6958. Springer, Berlin, 118--132.
[3]
Michael Alexander, Ken Agnew, and Miriam Goldberg. 2008. New approaches to residential direct load control in california. In Proceedings of the ACEEE Summer Study on Energy Efficiency in Buildings.
[4]
Ross Anderson and Shailendra Fuloria. 2010. On the security economics of electricity metering. In Proceedings of the9th Workshop on the Economics of Information.
[5]
Chip Berry. 2009. Residential Energy Consumption Survey. Technical Report. U.S. Energy Information Administration.
[6]
Daniel J. Butler, Justin Huang, Franziska Roesner, and Maya Cakmak. 2015. The privacy-utility tradeoff for remotely teleoperated robots. In Proceedings of the ACM/IEEE International Conference on Human-Robot Interaction (HRI’15). ACM, 27--34.
[7]
Colin Meehan. 2013. Increasing Demand Response Capabilities in California. Docket No. 13-IEP-1F. California Energy Commission, Sacramento, CA.
[8]
David Delparte. 2018. Business Practice Manual for Market Operations version 56. California Independent System Operators, Folsom, CA.
[9]
Michael R. Peevey. 2011. Decision Adopting Rules to Protect the Privacy and Security of the Electricity Usage Data of the Customers of Pacific Gas and Electric Company, Southern California Edison Company, and San Diego Gas 8 Electric Company. California Public Utilities Commission, San Francisco, CA.
[10]
D. S. Callaway and I. A. Hiskens. 2011. Achieving controllability of electric loads. Proc. IEEE 99, 1 (2011), 184--199.
[11]
Duncan S. Callaway. 2009. Tapping the energy storage potential in electric loads to deliver load following and regulation, with application to wind energy. Energ. Conv. Manage. 50, 5 (2009), 1389--1400.
[12]
Alvaro A. Cárdenas, Saurabh Amin, Galina Schwartz, Roy Dong, and S. Shankar Sastry. 2012. A game theory model for electricity theft detection and privacy-aware control in AMI systems. In Proceedings of the 50th Allerton Conference on Communication, Control, and Computing. 1830--1837.
[13]
Ann Cavoukian. 2011. Privacy by Design: Strong Privacy Protection -- Now, and Well into the Future. A Report on the State of PbD to the 33rd International Conference of Data Protection and Privacy Commissioners. Information 8 Privacy Commissioner, Ontario, Canada.
[14]
Thomas M. Cover and Joy A. Thomas. 1991. Elements of Information Theory. Wiley-Interscience.
[15]
T. Dalenius. 1977. Towards a methodology for statistical disclosure control. Statistik Tidskrift 15 (1977), 429--444.
[16]
Department of Energy. 2010. Data Access and Privacy Issues Related to Smart Grid Technologies. Department of Energy, Washington, D.C.
[17]
W. Diffie and M. E. Hellman. 1979. Privacy and authentication: An introduction to cryptography. Proc. IEEE 67, 3 (Mar. 1979), 397--427.
[18]
R. Dong, W. Krichene, A. M. Bayen, and S. S. Sastry. 2015. Differential privacy of populations in routing games. In Proceedings of the 2015 54th IEEE Conference on Decision and Control (CDC’15). 2798--2803.
[19]
Roy Dong, Lillian Ratliff, Henrik Ohlsson, and S. Shankar Sastry. 2014. Fundamental limits of nonintrusive load monitoring. In Proceedings of the 3rd International Conference on High Confidence Networked Systems (HiCoNS’14). ACM, 11--18.
[20]
Roy Dong, Lillian J. Ratliff, Henrik Ohlsson, and S. Shankar Sastry. 2013. Energy disaggregation via adaptive filtering. In Proceedings of the 2013 51st Annual Allerton Conference on Communication, Control, and Computing (Allerton’13). 173--180.
[21]
F. du Pin Calmon and N. Fawaz. 2012. Privacy against statistical inference. In Proceedings of the 2012 50th Annual Allerton Conference on Communication, Control, and Computing (Allerton’12). 1401--1408.
[22]
Cynthia Dwork. 2006. Differential privacy. In Proceedings of the International Colloquium on Automata, Languages and Programming. Springer, 1--12.
[23]
Cynthia Dwork and Aaron Roth. 2014. The Algorithmic Foundations of Differential Privacy. Foundations and Trends in Theoretical Computer Science.
[24]
M. Faisal and A. A. Cárdenas. 2015. How the quantity and quality of training data impacts re-identification of smart meter users. In Proceedings of the IEEE Smart Grid Communications Conference.
[25]
J. Giraldo, A. Cárdenas, E. Mojica-Nava, N. Quijano, and R. Dong. 2014. Delay and sampling independence of a consensus algorithm and its application to smart grid privacy. In Proceedings of the IEEE 53rd Annual Conference on Decision and Control. 1389--1394.
[26]
Bennie G. Thompson. 2011. Electricity Grid Modernization: Progress Being Made on Cybersecurity Guidelines, But Key Challenges Remain to Be Addressed. Report to Congressional Requesters. United States Government Accountability Office, Washington, D.C.
[27]
Bernard G. Greenberg, Abdel-Latif A. Abul-Ela, Walt R. Simmons, and Daniel G. Horvitz. 1969. The unrelated question randomized response model: Theoretical framework. J. Am. Statist. Assoc. 64, 326 (1969), 520--539. arXiv:http://www.tandfonline.com/doi/pdf/10.1080/01621459.1969.10500991
[28]
Shuo Han, Ufuk Topcu, and George J. Pappas. 2014. Differentially private distributed constrained optimization. arXiv (2014).
[29]
Te Han and S. Verdú. 1994. Generalizing the fano inequality. IEEE Trans. Inf. Theory 40, 4 (1994), 1247--1251.
[30]
Justin Hsu, Zhiyi Huang, Aaron Roth, and Zhiwei Steven Wu. 2014. Jointly private convex programming. arXiv (2014).
[31]
Zhenqi Huang, Yu Wang, Sayan Mitra, and Geir E. Dullerud. 2014. On the cost of differential privacy in distributed control systems. In Proceedings of the 3rd International Conference on High Confidence Networked Systems (HiCoNS’14). ACM, New York, NY, 105--114.
[32]
I. A. Ibragimov and R. Z. Has’minskii. 1991. Statistical Estimation—Asymptotic Theory. Springer-Verlag New York.
[33]
Ruoxi Jia, Roy Dong, S. Shankar Sastry, and Costas Spanos. 2016. Privacy-enhanced architecture for occupancy-based HVAC control (submitted).
[34]
Richeng Jin, Xiaofan He, and Huaiyu Dai. 2017. On the tradeoff between privacy and utility in collaborative intrusion detection systems-a game theoretical approach. In Proceedings of the Hot Topics in Science of Security: Symposium and Bootcamp (HoTSoS’17). ACM, New York, NY, 45--51.
[35]
Robert W. Keener. 2010. Theoretical Statistics: Topics for a Core Course. Springer.
[36]
Klaus Kursawe, George Danezis, and Markulf Kohlweiss. 2011. Privacy-friendly aggregation for the smart-grid. In Proceedings of the 11th International Conference on Privacy Enhancing Technologies (PETS’11). 175--191.
[37]
L. Le Cam. 1973. Convergence of estimates under dimensionality restrictions. Ann. Stat. 1, 1 (1973), 38--53.
[38]
J. Le Ny and G. J. Pappas. 2014. Differentially private filtering. IEEE Trans. Autom. Contr. 59, 2 (2014), 341--354.
[39]
Fenjun Li, Bo Luo, and Peng Liu. 2010. Secure information aggregation for smart grids using homomorphic encryption. In Proceedings of the 1st IEEE International Conference on Smart Grid Communications (SmartGridComm’10). 327--332.
[40]
J. Lin, W. Yu, N. Zhang, X. Yang, H. Zhang, and W. Zhao. 2017. A survey on internet of things: Architecture, enabling technologies, security and privacy, and applications. IEEE IoT J. 4, 5 (Oct 2017), 1125--1142.
[41]
M. A. Lisovich, D. K. Mulligan, and S. B. Wicker. 2010. Inferring personal information from demand-response systems. IEEE Secur. Priv. 8, 1 (2010), 11--20.
[42]
Ning Lu. 2012. An evaluation of the HVAC load potential for providing load balancing service. IEEE Trans. Smart Grid 3, 3 (2012), 1263--1270.
[43]
Ning Lu and Yu Zhang. 2013. Design considerations of a centralized load controller using thermostatically controlled appliances for continuous regulation reserves. IEEE Trans. Smart Grid 4, 2 (2013), 914--921.
[44]
J. L. Mathieu, S. Koch, and D. S. Callaway. 2013. State estimation and control of electric loads to manage real-time energy imbalance. IEEE Trans. Power Syst. 28, 1 (2013), 430--440.
[45]
S. Moura, J. Bendtsen, and V. Ruiz. 2013. Observer design for boundary coupled PDEs: Application to thermostatically controlled loads in smart grids. In Proceedings of the IEEE 52nd Annual Conference on Decision and Control. 6286--6291.
[46]
Arvind Narayanan and Vitaly Shmatikov. 2006. How to break anonymity of the netflix prize dataset. arXiv:cs/0610105. Retrieved from https://arxiv.org/abs/cs/0610105
[47]
J. Neyman and E. S. Pearson. 1933. On the problem of the most efficient tests of statistical hypotheses. Philos. Trans. Roy. Soc. Lond. A 231, 1 (1933), 289--337.
[48]
Helen Nissenbaum. 2004. Privacy as contextual integrity. Washington Law Review 79, 1 (2004), 119--158.
[49]
North American Energy Standards Board. 2015. NAESB Privacy Policy. Retrieved April 25, 2018 from https://www.naesb.org/privacy.asp.
[50]
Aneesh Chopra, Vivek Kundra, and Phil Weiser. 2011. A Policy Framework for the 21st Century Grid: Enabling Our Secure Energy Future. National Science and Technology Council (NSTC) Subcommittee on Smart Grid, Washington, D.C.
[51]
Cristian Perfumo, Ernesto Kofman, Julio H. Braslavsky, and John K. Ward. 2012. Load management: Model-based control of aggregate power for populations of thermostatically controlled loads. Energ. Conv. Manage. 55, 1 (2012), 36--48.
[52]
Public Utility Commission of Texas. 2014. Electric Substantive Rules -- Chapter 25. (2014).
[53]
S. R. Rajagopalan, L. Sankar, S. Mohajer, and H. V. Poor. 2011. Smart meter privacy: A utility-privacy framework. In Proceedings of the 2011 IEEE International Conference on Smart Grid Communications (SmartGridComm’11). 190--195.
[54]
Lillian J. Ratliff, Carlos Barreto, Roy Dong, Henrik Ohlsson, Alvaro Cárdenas, and S. Shankar Sastry. 2015. Effects of risk on privacy contracts for demand-side management. arXiv:1409.7926v3 (2015).
[55]
Alfredo Rial and George Danezis. 2011. Privacy-preserving smart metering. In Proceedings of the 10th Annual ACM Workshop on Privacy in the Electronic Society (WPES’11). ACM, 49--60.
[56]
Franziska Roesner, James Fogarty, and Tadayoshi Kohno. 2012. User interface toolkit mechanisms for securing interface elements. In Proceedings of the 25th Annual ACM Symposium on User Interface Software and Technology (UIST’12). ACM, New York, NY, 239--250.
[57]
N. Ruiz, I. Cobelo, and J. Oyarzabal. 2009. A direct load control model for virtual power plant management. IEEE Trans. Power Syst. 24, 2 (2009), 959--966.
[58]
L. Sankar, S. R. Rajagopalan, and H. V. Poor. 2013. Utility-privacy tradeoffs in databases: An information-theoretic approach. IEEE Trans. Inf. Forens. Secur. 8, 6 (2013), 838--852.
[59]
Richard Shay, Saranga Komanduri, Adam L. Durity, Phillip (Seyoung) Huh, Michelle L. Mazurek, Sean M. Segreti, Blase Ur, Lujo Bauer, Nicolas Christin, and Lorrie Faith Cranor. 2016. Designing password policies for strength and usability. ACM Trans. Inf. Syst. Secur. 18, 4, Article 13 (May 2016), 34 pages.
[60]
Glenn Smith. 2012. Marijuana bust shines light on utilities. Retrieved April 30, 2018 from https://www.postandcourier.com/news/marijuana-bust-shines-light-on-utilities/article_f63a8bed-9a43-5429-aaef-99f7eb0f71f0.html.
[61]
Daniel J. Solove. 2002. Conceptualizing privacy. Cali. Law Rev. 90, 4 (2002), 1087.
[62]
J. A. Stankovic. 2014. Research directions for the internet of things. IEEE IoT J. 1, 1 (Feb. 2014), 3--9.
[63]
L. Sweeney. 2002. k-anonymity: A model for protecting privacy. International Journal on Uncertainty, Fuzziness and Knowledge-Based Systems 10, 5 (2002), 557--570.
[64]
G. Taban and V. D. Gligor. 2009. Privacy-preserving integrity-assured data aggregation in sensor networks. In Proceedings of the International Conference on Computational Science and Engineering, Vol. 3. 168--175.
[65]
Gary Locke and Patrick D. Gallagher. 2014. NISTIR 7628 -- Guidelines for Smart Grid Cyber Security: Vol. 2, Privacy and the Smart Grid. The Smart Grid Interoperability Panel—Cyber Security Working Group, Washington, D.C.
[66]
Alexandre B. Tsybakov. 2009. Introduction to Nonparametric Estimation. Springer, New York.
[67]
Stanley L. Warner. 1965. Randomized response: A survey technique for eliminating evasive answer bias. J. Am. Stat. Assoc. 60, 309 (1965), 63--69. arXiv:http://www.tandfonline.com/doi/pdf/10.1080/01621459.1965.10480775 12261830
[68]
X. Yang, T. Wang, X. Ren, and W. Yu. 2017. Survey on improving data utility in differentially private sequential data publishing. IEEE Trans. Big Data 1, 1 (2017), 1--1.
[69]
Bin Yu. 1997. Assouad, fano, and le cam. In Festschrift for Lucien Le Cam. Springer, Berlin, 423--435.

Cited By

View all

Recommendations

Reviews

Fjodor J. Ruzic

The Internet of Things (IoT), much more than other fields in computer science (CS), introduces new issues related to inferential and differential privacy. The growing use and sophistication of IoT deployment generates increasing volumes of inferential data about individuals and creates new challenges to privacy law assessment. Further, inferential privacy within IoT ecosystems is actually implied by differential privacy when data is independent, but could also be differential when data correlates. The authors successfully discover the problem of inferential privacy when IoT infrastructures are in use, especially through various models of smart grid networks. They also challenge the current research on data privacy in smart grid and IoT infrastructures. These studies provide novel mechanisms for protecting the collected data: anonymization and aggregation via a differential privacy approach. It is interesting how the authors define the utility-privacy tradeoff of the IoT infrastructures using a two-tier approach: model the tradeoff between the data collection process and IoT device performance, and acquire knowledge about the tradeoff between how much data is collected and the use of personal (private) information in the processing of collected data through the IoT infrastructure. Naturally, this is not only a technical area problem; data protection (privacy law) should also be included, defining what data is actually private and what data must not be included in smart grid infrastructure operations providing utility services. The authors clearly describe these issues through electric utilities based on smart grid technologies. They try to discover scientific principles on which further research could be processed and to provide basic propositions of privacy issues for the real-world deployment of utility services through the IoT infrastructure. Thus, they present a utility-privacy framework with a specific privacy-preserving mechanism, finding the proper relation between the data collection volume and the needed level of functionality of the IoT infrastructure on which utility services are providing to the customer. The authors also effectively discuss two aspects of data: utility and privacy. These notions are related to the study of inferential privacy, a subject that is more applicable to smart-grid-based utility services. It is broadly defined through a utility-privacy framework, describing direct load control (DLC) programs with the presented model and simulations. The paper includes privacy analysis using a DLC program model based on data collected from real-world utility services deployment. This study provides a novel approach to the privacy issues within the IoT infrastructure, especially within smart-grid-based utility services. Thus, utility privacy is the focus of this excellent paper. It would be of interest to researchers in the field of privacy who are challenged by the new technology, as well as technicians working on smart-grid-based utility services. It is also a valuable resource for electrical engineering and CS libraries.

Access critical reviews of Computing literature here

Become a reviewer for Computing Reviews.

Comments

Information & Contributors

Information

Published In

cover image ACM Transactions on Cyber-Physical Systems
ACM Transactions on Cyber-Physical Systems  Volume 2, Issue 2
Special Issue on the Internet of Things: Part 1
April 2018
180 pages
ISSN:2378-962X
EISSN:2378-9638
DOI:10.1145/3229080
  • Editor:
  • Tei-Wei Kuo
Issue’s Table of Contents
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Publisher

Association for Computing Machinery

New York, NY, United States

Journal Family

Publication History

Published: 23 May 2018
Accepted: 01 January 2018
Revised: 01 June 2017
Received: 01 July 2016
Published in TCPS Volume 2, Issue 2

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. Privacy
  2. smart grid

Qualifiers

  • Research-article
  • Research
  • Refereed

Funding Sources

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)170
  • Downloads (Last 6 weeks)28
Reflects downloads up to 24 Jan 2025

Other Metrics

Citations

Cited By

View all

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Login options

Full Access

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media