SensorSafe : Managing Health-related Sensory Information with Fine-grained Privacy Controls

Miniature wireless sensors, worn by individuals or embedded in assistive devices carried by them, allow health-related data about individuals to be continually gathered as they lead their daily lives, outside the confines of clinics, hospitals, and laboratories. With their ability to provide insight into individuals' physical, physiological, psychological, and behavioral states that cannot be measured from sporadic testing and retrospective self-reporting, these sensing systems are revolutionizing both research and practice of medicine. However, with such ubiquitous sensing come new challenges of information privacy. Contemporary privacy practices in managing health data center on the notion of "personally identifiable information'' and "informed consent''. But the traditional approach to privacy, such as removing explicit identifiers, encrypting data, using trusted software, and securing servers, is not enough for the highly personal information traces captured by the sensors. Embedded in the sensor traces is information that correlates with our identity and our behaviors. When combined with publicly available innocuous facts the so called "digital footprints'' and "information breadcrumbs'' that we all leave behind as we lead our lives these sensor information traces can be de-anonymized, and individuals' identities and life patterns can be inferred statistically. To address this challenge, we have designed SensorSafe, a system for privacy-aware and secure management of health-related sensory information flows. SensorSafe enables individuals to retain control over their sensor data throughout its life cycle: its capture, processing, sharing, retention, and reuse. The core mechanism is a framework for individuals to specify fine-grained privacy rules on disclosure of sensory information to authenticated users based on its value, location-stamp, time-stamp, and other attributes. These rules are integrated with a flexible query framework using which applications and other consumers of data access the sensor information in a privacy-regulated manner. We describe the design and implementation details of our system, and evaluate its application and performance in several usage scenarios.