Privacy protection without impairing personalization by using the extended system MASKS and the extended contextualized P3P privacy policies

ABSTRACT

Current privacy protection mechanisms are limited to provide privacy guarantees for Web data gathering. MASKS system provides user's anonymity and allowance for implicit data collection, although it lacks security for collecting explicit data. It does not allow browsing session by dividing cookies into different groups of interest. Project 3P introduces a mechanism to keep users aware of privacy policies while navigating through the sites. It offers low reliability for implicit data gathering. Thus, developing a system to combine an extended MASKS system and an extended P3P ensures existing qualities of both mechanisms and supplies each other's limitations. The extended MASKS system includes sessions in the masking proxy to enable browsing session creation. The extended P3P incorporates information about user's benefits by increasing his/her understanding on privacy practices. Running comparative tests with users allows an evaluation on advantages by using this new combined system. The results showed that the combined system provides users' navigation with higher reliability. Thus, the implementation of this system proves useful for providing privacy during Web browsing, without impeding data gathering.

REFERENCES

• 1: Anonymizer. Anonymizer enterprise network privacy/security appliance, 2004. Anonymizer Inc.
• 2: L. Behrens. Privacy and security: The hidden growth strategy, August 2001.
• 3: R. E. Bucklin, J. M. Lattin, A. Ansari, D. Bell, E. Coupey, S. Gupta, J. D. C. Little, C. Mela, A. Montgomery, and J. Steckel. Choice and the internet: from clickstream to research stream. In U. C. Berkeley 5th Invitational Choice Symposium, pages 245--258. Mareting Letters, February 2002.
• 4: A. Cavoukian. Data mining: Staking a claim on your privacy, 1998. Technical report, Information and Privacy Commissioner.
• 5: Lorrie Faith Cranor, 'I didn't buy it for myself' privacy and ecommerce personalization, Proceedings of the 2003 ACM workshop on Privacy in the electronic society, October 30, 2003, Washington, DC [doi>10.1145/1005140.1005158]
• 6: DTI. Informing consumers about e-commerce, September 2001. Department for Trade and Industry. Conducted by MORI.
• 7: Eran Gabber , Phillip B. Gibbons , Yossi Matias , Alain J. Mayer, How to Make Personalized Web Browising Simple, Secure, and Anonymous, Proceedings of the First International Conference on Financial Cryptography, p.17-32, February 24-28, 1997
• 8: David Goldschlag , Michael Reed , Paul Syverson, Onion routing, Communications of the ACM, v.42 n.2, p.39-41, Feb. 1999 [doi>10.1145/293411.293443]
• 9: L. Ishitani. Uma Arquitetura para Controle de Privacidade na Web. PhD thesis, Dept. of Computer Science Universidade Federal de Minas Gerais, Minas Gerais, Brazil, 2003.
• 10: Lucila Ishitani , Virgilio Almeida , Wagner Meira Jr., Masks: Bringing Anonymity and Personalization Together, IEEE Security and Privacy, v.1 n.3, p.18-23, May 2003 [doi>10.1109/MSECP.2003.1203218]
• 11: D. Jutla and P. Bodorik. A client-side business model for electronic privacy. In 16th Bled eCommerce Conference and Transformation, pages 463--479, Bled, Slovenia, June 2003.
• 12: Alfred Kobsa, Tailoring Privacy to Users' Needs, Proceedings of the 8th International Conference on User Modeling 2001, p.303-313, July 13-17, 2001
• 13: A. Kobsa and M. Teltzrow. Contextualized communication of privacy practices and personalization benefits: Impacts on users' data sharing and purchase behavior. In Privacy Enhancing Technologies: Fourth International Workshop, pages 329--343, Toronto, Canada, 2004. Springer LNCS.
• 14: D. Kristol and L. Montulli. HTTP State Management Mechanism. Bell Laboratories, Lucent Technologies, October 2000.
• 15: A. L. Montgomery, S. Li, K. Srinivasan, and J. C. Liechty. Modeling online browsing and path analysis using clickstream data. Marketing Science, 23(4):579--595, 2004.
• 16: R. Morgan. Community attitudes towards privacy, June 2004. Technology Overview. Roy Morgan Research.
• 17: Michael K. Reiter , Aviel D. Rubin, Crowds: anonymity for Web transactions, ACM Transactions on Information and System Security (TISSEC), v.1 n.1, p.66-92, Nov. 1998 [doi>10.1145/290163.290168]
• 18: Bruno Gusmão Rocha , Virgílio A. F. Almeida , Lucila Ishitani , Wagner Meira, Jr., Disclosing users' data in an environment that preserves privacy, Proceedings of the 2002 ACM workshop on Privacy in the Electronic Society, p.71-80, November 21-21, 2002, Washington, DC [doi>10.1145/644527.644535]
• 19: Maximilian Teltzrow , Alfred Kobsa, Impacts of user privacy preferences on personalized systems: a comparative study, Designing personalized user experiences in eCommerce, Kluwer Academic Publishers, Norwell, MA, 2004
• 20: M. Teltzrow and A. Kobsa. Communication of privacy and personalization in e-business. proceedings of the workshop. In WHOLES: A Multiple View of Individual Privacy in a Networked World, Stockholm, Sweden, 2004.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.3 Communications Applications

Additional Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues

General Terms:
Design, Experimentation, Reliability, Security, Verification

Keywords:
navigation, personalization, privacy, user, web