People often unnecessarily disclose identity information online and puts their privacy at risk. Computer warnings mitigate needless identity disclosure. People, however, often click the OK button without reading warning messages. We utilize eye gaze information to provide dynamic warnings. The dynamic warnings are designed to display just-in-time and then fade out after users read them. They are shown right next to the location where users look. We built a restaurant reservation app to evaluate our dynamic warning system. We conducted an experiment with follow-up surveys. The results showed that our dynamic warnings reduced unnecessary identity disclosure and that they were around 5 times more effective than a Windows warning with a close button. We also found that the longer users’ eyes registered on dynamic warning, the less likely users were to provide their identify information in the dynamic warning condition experiment.

In social interactions, we remember faces and associate names that we hear to the faces. Existing research has studied single-item memory tasks such as names, face, colors, shapes, and classified their associations using spectral analysis, event-related potentials(ERPs), and non-ensemble machine learning techniques. However, the impact of multiple stimuli presentation modalities in the associative memory of face-name stimuli has not been extensively investigated. In this research, we conducted two experiments on audiovisual face-name and visuospatial face-name memory tasks. We recorded EEG data from 15 healthy participants and extracted the average oscillatory band power of the alpha, theta, beta, and gamma bands and the signal entropy. Adaptive Logistic boosting was applied for classification, and t-test statistical analyses were applied to investigate participants’ behavioral performance. We found that people did better on visuospatial face-name memory association than audiovisual face-name memory association. Adaptive boosting performed best in comparison to other existing algorithms with the average classification accuracy of 76.37% at the parietal electrode P7.

Electroencephalography(EEG) signals have been used to assess the efficiency of recall based on the evaluation of memories remembered or forgotten. There is need for an EEG noise/outlier resistant algorithm with a good classification accuracy. In this paper, we present a new technique for EEG signal classification to study whether a person remembers faces he or she has seen or not. For this purpose, our method applies denoising using discrete wavelet transform, time-locked EEG activity before generating templates for each class that indicates whether a person remembered or forgot. This novel technique was compared with well-known classification algorithms such as Discriminant Analysis (DA), Support Vector machines (SVM using linear kernel) and Decision Trees (DT). Our Template Matching for EEG Single trial (ETMEST) technique outperformed them all. For all subjects, the average classification accuracy of ETMEST was 94%. Also, we applied this technique on a visually evoked potential EEG dataset based on c-VEP BCI speller system to detect symbol/alphabet recognition events. The results show this method can be reliably applied to EEG-based Communication, Brain Computer Interface(BCI) applications and other signal classification problems. It is additionally surmised from this investigation that during memory encoding, the signals from the frontal and temporal lobes are the strongest and during decoding, signals from the frontal and parietal lobes are the strongest.

The objective of this research was to identify aspects of warnings that will reduce online disclosure of personal information, specifically aspects that people do not consider sensitive. The vast majority of online commercial websites collect personal data, and many consumers report cybercrime events, such that identity theft is a significant risk. Most people can be uniquely identified by the combination of their birth date, age, and gender. This is problematic, since people do not believe these identity elements to be important to safeguard. Participants were asked to provide personal information to receive an online insurance quote. Participants in experimental conditions were warned not to disclose their date of birth. The experimental manipulations were (a) the vividness of the warnings and (b) whether an alternative to disclosure was recommended. Analyses indicated that providing an alternative to disclosure proved to be an effective strategy to reduce disclosure. Personal information disclosure can be reduced through warnings, but warnings need to be carefully designed and tested. Clear recommendations for alternative behavior may be especially effective. Designers of warnings and alerts can use the principles identified in this research to make their messages more effective.

Identity theft is an increasing threat to individuals, institutions, and the economy. People are often not adequately cautious with the disclosure of their personal information in digital contexts and may make poor decisions to reveal private information. Warnings reduce unnecessary information exposure, but the effectiveness may depend on source credibility and expertise on influencing risk perceptions and attitudes. The warnings must be designed for users acting in a digital context. The current research was conducted to determine whether adding a trustworthy and expert source to a message that warned individuals not to disclose their personal information would impact decisions to disclose. First, a survey (pilot study) was conducted to identify the source considered the most trustworthy (among Google, FBI Cyber Division, and Department of Justice) and competent with respect to online security. Google received the highest ratings. In a later experiment, warnings with sources did reduce the extent of disclosure, with the FBI Cyber Division (not Google) being the most effective source. The results indicate that warnings need to be tested with respect to the actual target behavior (in this case, disclosure), rather than relying on individuals’ perceptions of trust, risk, or influence of a warning message when designing effective warnings.

Pervasive computing environments consist of thousands of heterogeneous devices and network services. Service discovery protocols provide essential functionalities for users and client devices to discover and access services. Most existing protocols, however, only support discovery via static service attributes. Dynamic information such as service conditions, quality, and reliability is not available to users and clients. To disseminate dynamic service information, we need to properly control the communication and computational overhead. Thus, the solution will be viable for resource-constrained devices. We propose a novel service discovery approach, called DynamicSD. We use mathematical models-Markov Chains-to represent dynamic and uncertain service states. The Markov Chains are disseminated among clients, services, and directories. By deriving the properties of the Markov Chains, we attain dynamic service information. To the best of our knowledge, this is the first formal model to represent dynamic and uncertain service conditions in service discovery protocols. We implement a prototype protocol on wireless sensors. The performance measurements show that the communication and computational overhead that we introduce is low.

In mobile and pervasive computing environments, users may easily exchange information via ubiquitously available computers ranging from sensors, embedded processors, wearable and handheld devices, to servers. The unprecedented level of interaction between users and intelligent environments poses unparalleled privacy challenges. We identify a new attack that can be used to acquire users' private information---using reciprocity norms. By mutually exchanging information with users, an attacker may use a psychological method, the norm of reciprocity, to acquire users' private information. We implemented software to provide a rich shopping experience in a mobile and pervasive computing environment and embedded the reciprocity attack. Our experiments showed that participants were more willing to provide some types of private information under reciprocity attacks. To the best of our knowledge, this is the first attempt to understand the impact of the norm of reciprocity as an attack in mobile and pervasive computing environments. These human factors should be taken into consideration when designing security measures to protect people's privacy.

In pervasive computing environments, personal information is typically expressed in digital forms. Daily activities and personal preferences with regard to pervasive computing applications are easily associated with personal identities. Privacy protection is a serious challenge. The fundamental problem is the lack of a mechanism to help people expose appropriate amounts of their identity information when accessing pervasive computing applications. In this paper, the authors propose the Hierarchical Identity model, which enables the expression of one’s identity information ranging from precise detail to vague identity information. The authors model privacy exposure as an extensive game. By finding subgame perfect equilibria in the game, the approach achieves optimal exposure. It finds the most general identity information that a user should expose and which the service provider would accept. The authors’ experiments show that their models can reduce unnecessary identity exposure effectively.

Various miniaturized computing devices that store our identities are emerging rapidly. They allow our identity information to be easily exposed and accessed via wireless networks. When identity information is associated with our personal and context information that is gathered by ubiquitous computi

In pervasive computing environments, personal information is expressed in digital forms to a great extent. Daily activities and personal preferences may be easily associated with personal identities. Privacy protection is a serious challenge. The fundamental problem is the lack of a mechanism to help people expose appropriate amounts of their identity information. We propose the Hierarchical Identity model. It expresses one's identity information from precise to general. We model privacy exposure as an extensive game. By finding the subgame perfect equilibria in the games, our approach achieves optimal exposure. It finds the most general identity information that a user wants to expose and a service provider accepts.

In pervasive computing environments, service discovery is an essential step for computing devices to properly discover, configure, and communicate with each other. We introduce a user-centric service discovery model, called PrudentExposure, which automates authentication processes. Traditional authentication approaches requires much users’ involvement. PrudentExposure encodes hundreds of authentication messages in a novel code word form. Moreover, we discuss how a progressive and probabilistic model can protect both users’ and service providers’ privacy. Perhaps the most serious challenge for pervasive service discovery is the integration of computing devices with people. In a challenging case, both users and service providers want the other parties to expose sensitive information first. Our model protects both users and service providers.

The involvement of only the necessary users and service providers for service discovery in pervasive computing environments is challenging. Without prudence, users' and service providers' requests or service information, their identities, and their presence information may be sacrificed. We identify that the problem may be as difficult as a chicken-and-egg problem, in which both users and service providers want the other parties to expose sensitive information first. In this paper, we propose a progressive and probabilistic approach to solve the problem. Users and service providers expose partial information in turn and avoid unnecessary exposure if there is any mismatch. Although 1 or 2 bits of information are exchanged in each message, we prove that the process converges and that the false-positive overhead decreases quickly. Experiments and hypothesis tests show that security properties hold. We implemented the approach and the performance measurements show that the approach runs efficiently on PDAs.

We propose a novel entity authentication approach for pervasive computing environments. A person uses a single device, the master key, which aggregates all his digital forms of access tokens for entity authentication. The master key discovers and selects proper tokens for its owner. With an emphasis on usability, the master key secures authentication, protects privacy information from outsiders and insiders, and supports various claimant-verifier relations. We analyze privacy and security properties of our approach and protocols, and we investigate the overhead. Performance measurements show that our protocols are efficient

Service Discovery as an essential element in pervasive computing environments is widely accepted. Much research on service discovery has been conducted, but privacy and security have been ignored and may be sacrificed. While it is essential that legitimate users should be able to discover services, it is also necessary that services be hidden from illegitimate users. Since service information, service provider's information, service requests, user presence information, and user's identities may be sensitive, we may want to keep them private during service discovery processes. There appears to be no existing service discovery protocols that solve these problems. We present a user-centric model, called Prudent Exposure, which exposes minimal information privately and securely. Users and service owners exchange code words in an efficient and scalable form to establish mutual trust. Based on the trust, secure service discovery sessions are set up. The model is further improved to counter attacks. We analyze the mathematical properties of our model, formally verify our security protocol, and measure the performance of our prototype system.

In pervasive computing environments, service discovery facilitates users to access network services by automating tedious manual configurations. When network services become pervasive, the number of service providers also increase dramatically. Because of security and privacy concerns, network services are segmented by service providers. Existing service discovery protocols, however, do not address how to facilitate users to properly identify and authenticate with existing service providers. Without prudence, sensitive information may be exposed. Conversely, with prudence both users and service providers prefer the other party to expose sensitive information first. We identify that even among legitimate users and service providers, there are privacy concerns that may be expressed as a chicken-and-egg problem. In this paper, we propose a progressive approach to solve the problem. Users and service providers expose minimal sensitive information in turn and identify necessary exposure during the process. Theoretical analysis, simulation, and experiments show that our approach protects sensitive information with little overhead.

Service discovery as an essential element in pervasive computing environments is widely accepted. Much active research on service discovery has been conducted, but privacy has been ignored and may be sacrificed. While it is essential that legitimate users should be able to discover services of which they have credentials, it is also necessary that services be hidden from illegitimate users. Since service information, service provider's information, service requests, and credentials to access services via service discovery protocols may be sensitive, we may want to keep them private. Existing service discovery protocols do not solve these problems. We present a user-centric model, called Prudentexposure, as the first approach designed for exposing minimal information privately, securely, and automatically for both service providers and users of service discovery protocols. We analyze the mathematical properties of our model and formally verify our security protocol.

Securely accessing unfamiliar services in public environments using ad hoc wireless networks is challenging. We present a proxy-based approach that uses other existing network channels to set up a secure and trust relationship between communication parties to facilitate ad hoc wireless communications. Based on a service discovery protocol, our models achieve secure, trusted, anonymous, efficient, and economical communications between unfamiliar parties. Our protocols are formally verified using BAN logic.

In pervasive computing environments, powerful handheld devices with wireless connections create opportunities for many new nomadic applications. We propose a new service discovery model, called Splendor, supporting nomadic users and services in public environments. Splendor emphasizes security and supports privacy. Location awareness is integrated for location dependent services discovery and is used to lessen service discovery network infrastructure requirements. We analyze the Splendor system performance and provide our experimental results.