PaperlayerView exact revision on arXiv

Source-linked AI summary

Differential Privacy Techniques for Cyber Physical Systems: A Survey

Muneeb Ul Hassan, Mubashir Husain Rehmani, Jinjun Chen

arXiv:1812.02282v3cs.CR

TL;DR

CPS adoption has increased privacy risks, while conventional protections face limitations in modern, resource-constrained and data-intensive architectures. This paper surveys differential privacy implementations and applications across four CPS domains, synthesizing practical findings and unresolved challenges. The survey identifies differential privacy as a broadly applicable approach while highlighting continuing implementation and optimization challenges.

  • Problem

    CPSs process sensitive data across interconnected systems, creating privacy risks from passive attacks and motivating protection beyond conventional encryption and anonymization.

  • Method

    The paper provides a comprehensive survey of differential privacy techniques, implementations, and applications in energy, transportation, healthcare, and industrial IoT systems.

  • Results

    The survey finds differential privacy applied across major CPS domains to protect sensitive data while supporting legitimate analysis, reporting, and system functions.

  • Takeaways & Limitations

    Differential privacy provides a viable privacy-preservation approach for diverse CPS data scenarios, but practical deployment still requires solutions for low-memory devices and privacy-budget computation.

Abstract

from arXiv · show

Modern cyber physical systems (CPSs) has widely being used in our daily lives because of development of information and communication technologies (ICT).With the provision of CPSs, the security and privacy threats associated to these systems are also increasing. Passive attacks are being used by intruders to get access to private information of CPSs. In order to make CPSs data more secure, certain privacy preservation strategies such as encryption, and k-anonymity have been presented in the past. However, with the advances in CPSs architecture, these techniques also needs certain modifications. Meanwhile, differential privacy emerged as an efficient technique to protect CPSs data privacy. In this paper, we present a comprehensive survey of differential privacy techniques for CPSs. In particular, we survey the application and implementation of differential privacy in four major applications of CPSs named as energy systems, transportation systems, healthcare and medical systems, and industrial Internet of things (IIoT). Furthermore, we present open issues, challenges, and future research direction for differential privacy techniques for CPSs. This survey can serve as basis for the development of modern differential privacy techniques to address various problems and data privacy scenarios of CPSs.

I. INTRODUCTION

CPSs face serious privacy risks because their complex, sensor-rich architectures process large amounts of personal data, while conventional protections can be costly or vulnerable. The paper surveys differential privacy’s implementation and applications in CPSs, emphasizing practical coverage across four major domains and future challenges.

  • Motivation: CPS privacy is difficult to assess and protect because threats can target multiple components, including sensors, wearable devices, and industrial control systems.These systems contain extensive personal data, and leakage can enable blackmailing or false information injection.
  • Differential Privacy: Differential privacy perturbs query data with noise to make individuals indistinguishable, balancing privacy protection against reporting accuracy.Greater perturbation strengthens privacy but directly affects data accuracy.
  • Limitations of Existing Strategies: Encryption can be computationally complex for resource-constrained CPS sensors and may depend on interconnected nodes for key generation and data collection.A failed node in a network of n nodes can make decryption and data collection nearly impossible because keys are missing.
  • Limitations of Existing Strategies: Anonymization can remain vulnerable to re-identification, with four temporal points identifying a person from 15-minute mobility data with around 95% accuracy.The passage also notes similar weaknesses in anonymized credit-card transaction data.
  • Survey Scope: The survey addresses differential privacy’s practical implementation and applications in energy, transportation, healthcare, and industrial IoT systems.It also reviews prior surveys and outlines open issues, challenges, and future research directions.

C. Review of Related Survey Articles

Earlier differential-privacy surveys addressed domains such as statistical databases, social networks, mobile sensing, and big-data analytics, but did not comprehensively cover CPS applications and implementation.

  • CPS Survey Gap: The authors identify a gap: no prior detailed survey thoroughly addresses differential-privacy strategies, applications, and implementation across CPSs.Their survey organizes CPS coverage across energy, transportation, healthcare, medical, and IIoT contexts.
  • Scope of Previous Surveys: Previous surveys covered statistical databases, social networks, mobile sensing systems, finite precision semantics, sensitive data mining, recommender systems, and miscellaneous topics.The survey literature was categorized by application scenario and considered factors.
  • Scope of Previous Surveys: Existing survey work analyzed privacy budgets, data-release mechanisms, efficiency, accuracy, and differential-privacy utility in big-data and mobile-sensing contexts.These studies focused on salient privacy-related features and improving data utility.
  • Analytical Emphases: Previous surveys also examined privacy breaches, social-network techniques, and 54 differential-privacy variants using computational complexity and privacy-loss analyses.The reviewed variants were analyzed dimensionally, axiomatically, and relationally.

II. DIFFERENTIAL PRIVACY AND CYBER PHYSICAL SYSTEMS: AN OVERVIEW

The overview frames privacy preservation as protection against disclosure through attacks on statistical and CPS data, then introduces differential privacy’s formal concepts and implementation branches.

  • Privacy Threats: Privacy preservation aims to prevent intruders from learning more than the minimum required information about individuals in real-time or statistical data.The overview connects privacy protection to adversarial access and inference risks.
  • Privacy Attacks: Disclosure and linking attacks use observed traffic or external and anonymized datasets to infer critical information and re-identify individuals.Linking attacks become easier when adversaries combine datasets containing different information about the same people.
  • Privacy Attacks: Differencing attacks infer an individual’s sensitive attribute by combining repeated aggregate queries, motivating outputs that are not completely accurate.The example derives an individual’s diabetes status from two related aggregate queries.
  • Differential Privacy Foundations: Differential privacy seeks to prevent query outputs from revealing enough information to identify an individual, using a randomized algorithm over neighboring datasets.The formal setup considers possible outputs over adjacent datasets.
  • Differential Privacy Foundations: Epsilon controls the privacy level: lower ε provides stronger privacy, while global sensitivity determines the perturbation required by the mechanism.Global sensitivity is the maximum query-output difference between datasets differing in one element.
  • Implementation Perspectives: Differential-privacy methods are discussed through existing methods and noise-addition mechanisms, with implementation spanning real-time and stored data scenarios.The overview identifies distribution optimization and sensitivity calibration as method perspectives.

1) Differential Privacy Existing Methods:

The survey organizes differential-privacy methods by distribution optimization, sensitivity calibration, and dataset-oriented transformations, illustrating privacy–utility behavior with an exponential-mechanism example.

  • Distribution Optimization: Distribution optimization adjusts the differential-privacy probability density without accounting for the dataset directly.These techniques may use Laplacian or Exponential mechanisms and can be centralized or distributed.
  • Sensitivity Calibration: Sensitivity calibration improves utility by tuning, smoothing, and lowering sensitivity toward an optimal state.Distribution optimization and sensitivity calibration can also be adjusted together.
  • Method Selection: Users can combine a probability distribution such as Exponential or Laplacian with a required sensitivity value to configure protection.The combination reflects the interlinked roles of distribution choice and sensitivity.
  • Dataset-Oriented Methods: Dataset-oriented methods build synopses through decomposition, transformation, or compression while adding noise to reduce error and improve utility under ε-differential privacy.The supplied passage identifies synopsis construction as a major dataset-oriented category.
  • Exponential Mechanism Example: 0.2 at ε =0 represents a 20% chance of selecting a specific answer and is interpreted as 100% privacy, while 0.72 at ε =1 represents a 72% chance for headache and minimum privacy.The example demonstrates the privacy–utility trade-off in a medical-record setting.
  • Noise-Addition Mechanisms: Laplace, Gaussian, and Exponential mechanisms are the three generally used noise-addition mechanisms, with noise magnitude depending on sensitivity and privacy budget.The mechanism choice and perturbation magnitude determine the protection process described by the survey.

2) Data Perturbation Mechanisms:

The survey presents perturbation mechanisms for numerical and non-numerical outputs, alongside composition rules for combining differentially private analyses. These mechanisms balance privacy protection against utility through noise, sensitivity, and query structure.

  • Laplace Mechanism: Laplace mechanism perturbs each coordinate with Laplacian noise scaled according to function sensitivity and is generally used for numerical outputs.The randomized algorithm satisfies ε-differential privacy when the noise is calibrated to global sensitivity.
  • Exponential Mechanism: Exponential mechanism selects probability-weighted non-numerical answers using a score function and its sensitivity.The mechanism satisfies ε-differential privacy for possible answers evaluated by the score function.
  • Exponential Mechanism: With ε = 0, the exponential mechanism selects uniformly across five medical-record options, providing 100% privacy but minimum utility.At ε = 0, all possible outcomes have equal selection probability.
  • Exponential Mechanism: As ε increases from 0.1 to 1, the probability gap between Headache and Dehydration grows, indicating higher utility but reduced privacy.The passage describes ε = 0.1 as providing considerable privacy and ε = 1 as providing very high utility with reduced privacy.
  • Gaussian Mechanism: Gaussian mechanism adds noise drawn from a normal distribution as another building block for differential privacy algorithms.The passage specifies its use for query perturbation when ε lies between 0 and 1.
  • Composition Theorems: Sequential composition supports multiple differentially private iterations over the same dataset, while parallel composition applies to disjoint subsets and uses the worst individual guarantee.Sequential composition accumulates an nε bound, whereas parallel composition need not sum privacy costs across disjoint partitions.

C. Technical Challenges in Application of Differential Privacy

Applying differential privacy in CPSs involves technical challenges involving utility, privacy parameters, data correlation, and implementation complexity. The survey emphasizes unresolved choices about privacy guarantees and ε calibration.

  • Technical Challenges: Implementing differential privacy in emerging CPS applications faces numerous technical challenges despite the conceptual simplicity of data perturbation.The survey identifies these challenges across different application scenarios.
  • Privacy–Utility Trade-off: Privacy relaxation can preserve utility, but it permits some information leakage when analysts need useful statistical outputs.The passage contrasts bounded salary inference with preventing any salary inference during analysis.
  • Parameter Selection: Choosing an optimal ε remains unresolved because smaller ε increases noise and privacy while reducing output utility or accuracy.The survey notes that no rigorous method fully explains how to choose and generate ε for practical scenarios.
  • Data Correlation: Correlations among real-world records can help adversaries infer private information despite differential privacy’s neighboring-record protection model.The survey specifically identifies strong coupling and correlated records as disclosure risks.
  • Indistinguishability: Differential privacy aims to make outputs similar across datasets with and without an individual, limiting an adversary’s ability to distinguish that individual’s presence.Legitimate analysts should observe little difference in the resulting statistical outputs.

F. Cyber Physical Systems

CPSs integrate computation, communication, sensing, and physical processes across networked, hybrid, and distributed architectures. Their applications span infrastructure, transportation, healthcare, and industry.

  • Cyber Physical Systems: CPSs connect computation technologies with physical systems to control, monitor, sense, and transmit information about real-world processes.The survey traces their development from embedded control and feedback systems.
  • CPS Architecture: Modern CPS architectures comprise advanced connectivity for real-time data exchange and intelligent data management for computation and analysis.These are identified as the two major functional components of CPS architectures.
  • Networked Control Systems: Networked control systems exchange control and feedback signals between computing and physical devices through communication networks.Their defining feature is network-mediated interaction between system components.
  • Hybrid Systems: Hybrid systems model transitions between continuous and discrete operating states, while distributed hybrid systems combine dynamic, discrete, communication, and computation elements.Distributed hybrid systems compose several cyber and physical systems and require systematic correctness methods.
  • Application Domains: CPS applications include smart grids, intelligent transportation, healthcare and medical systems, and the Industrial Internet of Things.The survey presents these domains as selected application areas within the broad CPS research spectrum.

G. Motivation of Using Differential Privacy in CPSs

The survey motivates differential privacy for CPSs by their large-scale, sensitive, and often real-time data. It emphasizes lightweight perturbation, quantitative privacy–accuracy control, and application-specific design requirements.

  • Motivation: Differential privacy is presented as a potential privacy strategy for critical or public CPS information across academic and industrial settings.The survey describes its integration with modern CPSs as an active topic.
  • Lightweight Protection: Differential privacy is described as lightweight because it perturbs data rather than requiring the computationally complex key management of encryption.The survey contrasts its device requirements and computational burden with encryption strategies.
  • Quantitative Control: Differential privacy provides a quantitative basis for determining how much CPS data can be released and with what accuracy.This supports explicit consideration of privacy and utility in data-release decisions.
  • Data Protection: The original CPS dataset remains unchanged while noise is added so analysts can still use protected statistical or real-time data.The survey contrasts this with anonymization schemes that manipulate original values.
  • Large-Scale Queries: Large query lists can cause utility loss, motivating integration with machine learning and deep learning for listing, perturbation, and query evaluation.The survey presents this integration as a feasible response to large-database demands.
  • Social CPSs: Differential privacy can protect node and edge privacy in social CPSs, covering individual information and relationship information.The survey distinguishes protection of nodes from protection of specific relationships.
  • Application-Specific Requirements: CPS requirements differ by application: smart grids and transportation emphasize time-series or location privacy, while healthcare requires high privacy and accuracy.The survey also notes that industrial IoT has its own high-privacy requirements.

III. DIFFERENTIAL PRIVACY IN ENERGY SYSTEMS (SMART GRID)

Differential privacy in smart-grid energy systems addresses privacy risks from real-time and stored data while preserving utility for monitoring, demand response, and query evaluation. The surveyed implementations span direct perturbation, battery load balancing, fog computing, and smart-building sensing.

  • Privacy risks: Smart-grid data can reveal household routines, appliance usage, occupancy, and other personal information when exposed at high resolution.Real-time energy readings and demand-response data may support burglary planning, targeted advertising, or other monitoring.
  • Demand response: Demand response requires protected smart-meter data while retaining enough information for energy-efficiency and operational calculations.The survey describes Laplacian masking followed by demand-response calculation using individual appliance data.
  • Fog computing: Fog computing is combined with differential privacy to address transmission and storage delays in cloud-based smart-meter systems.The surveyed organization identifies fog-node integration as a distinct energy-system scenario.
  • Implementation scenarios: Differential privacy is organized in energy systems around direct data perturbation, battery load balancing, demand-response protection, and fog-node processing.These scenarios protect real-time smart-meter data while allowing stored data to support query evaluation.
  • Smart buildings: Smart buildings generate real-time sensor data whose leakage can threaten privacy, motivating differential-privacy protection for monitoring and query evaluation.The surveyed smart-building discussion connects sensor-data protection with hierarchical-stream query evaluation.

2) Home Traffic Analysis:

The surveyed smart-grid methods protect household and meter data across traffic analysis, battery load hiding, perturbation, and fog-computing settings. These approaches balance privacy protection with data utility and computational or response-time requirements.

  • Home Traffic Analysis: A differentially private traffic-obfuscation framework protects smart-home Internet traffic against privacy inference from machine-learning analysis.Its utility-aware exponential mechanism selects traffic gateways while targeting unlinkability and reduced network resource consumption.
  • Battery Load Balancing: Battery load hiding uses an external battery to balance load and conceal smart-meter data, while differential privacy supplies mathematical privacy analysis.The survey notes that direct battery load-hiding mechanisms lack proved evidence directly linking classification performance to privacy protection.
  • Differential Privacy with Battery Load Balancing: Direct perturbation protects real-time smart-meter readings, but noise dimensioning, ε, and sensitivity determine the privacy-utility behavior.Smart-meter data is not counting data, so its global sensitivity cannot automatically be set to 1.
  • Differential Privacy with Battery Load Balancing: Gaussian colored noise is reported to provide a desirable privacy level after encrypted aggregation of perturbed smart-meter data.The passage describes aggregation across multiple smart meters using Gaussian white and colored noise.
  • Fog Computing: Fog-based differential privacy aggregates smart-grid data at fog nodes and is described as protecting against NILM strategies.The surveyed fog approach uses a factorial hidden Markov model.

E. Summary and Lessons Learnt

The survey organizes differential-privacy applications across energy and transportation systems, where connected sensing and communication create privacy risks. It presents differential privacy as a viable approach for protecting diverse data while supporting query evaluation and system services.

  • Transportation systems: Transportation applications are organized into electric-vehicle, automotive-data, and train-transportation scenarios.The corresponding taxonomy further distinguishes railway networks, vehicular networks, and automotive manufacturers’ data-privacy techniques.
  • Transportation systems: Differential privacy protects transportation data such as vehicle information, demand response, charging schedules, and train-system data while retaining query-evaluation use.This organization is stated in the transportation-system illustration.
  • Railways Freight Network: Railway freight systems gain opportunities from big-data analytics but also face privacy and security risks as technology expands.The survey identifies differential privacy as a viable, computationally non-complex solution for railway-network privacy.
  • Vehicular Networks: Vehicular-network broadcasts can expose vehicle locations and sensitive behavioral or health-related inferences to passive eavesdroppers.Wireless V2V and V2D communication is identified as especially vulnerable to interception.
  • Electric vehicles: Electric-vehicle charging, discharging, auctions, and demand-response data require protection because public disclosure can compromise individual privacy.These data are exchanged through wireless sensor networks and cloud-computing infrastructure involving vehicles and swap stations.
  • Summary and Lessons Learnt: The transportation literature is summarized comparatively by technique, optimized parameters, privacy criterion, scenario, and experimental platform.The survey also uses figures to organize the application scenarios and taxonomy.

2) Vehicle Trajectory Protection:

Vehicle and healthcare CPS applications expose sensitive personal and operational data through connected devices, records, and real-time monitoring. Differential privacy is surveyed as a way to protect these data while retaining utility for analysis and services.

  • Vehicle Trajectory Protection: Collaborative intrusion detection systems share attack knowledge and labelled datasets among vehicles to improve detection and training.The passage describes CIDS as an advanced architecture for vehicular networks.
  • Vehicle Trajectory Protection: Connected vehicles expose users’ identities, locations, battery status, and charging or discharging schedules to privacy risks.These risks affect both transmitted vehicle data and personally identifiable information.
  • Healthcare and Medical Systems: Healthcare CPSs support real-time monitoring, remote care, elderly care, and storage or analysis of health records.The survey organizes healthcare differential privacy applications into real-time health data, electronic health records, and health survey data.
  • Healthcare and Medical Systems: Real-time health data such as heart rate, sleep conditions, blood pressure, and walking steps can create privacy concerns when disclosed unnecessarily.Such data may be shared with doctors, hospitals, or insurance companies.
  • Healthcare and Medical Systems: Re-DPoctor uses differential privacy for budget allocation and adaptive sampling, reducing mean relative error and mean absolute error in transmitted health data.The scheme is presented with a proportional-integral-plus controller to examine the privacy–utility trade-off.

B. E-Health Records

Electronic health records contain highly sensitive personally identifiable information and are commonly protected through obscuring or anonymization. Surveyed differential privacy methods address private querying and privacy-preserving clinical-data learning, while healthcare systems continue to face broad privacy challenges.

  • B. E-Health Records: Electronic health records contain sensitive personally identifiable information including disease status, symptoms, heart rate, and blood pressure.The passage notes that these records are increasingly stored electronically and outsourced.
  • B. E-Health Records: Obscuring and anonymization are commonly used during preparation and cleaning of electronic health datasets.The survey presents differential privacy as an alternative or complementary protection strategy for these records.
  • B. E-Health Records: A heuristic hierarchical query method and private partition algorithm were proposed to improve query time, overhead, and query error under differential privacy.The cited work targets private querying of electronic health data.
  • B. E-Health Records: Private stochastic gradient descent perturbs clinical data for end-to-end differential privacy while targeting training accuracy and efficiency.The approach was integrated with cryptographic encryption for additional protection.
  • B. E-Health Records: Healthcare differential privacy still requires substantial work across applications, including machine learning and lightweight algorithms for wearable devices.The survey specifically identifies smaller body sensors and wearables as requiring less complex privacy methods.

INTERNET OF THINGS

The survey organizes differential privacy in industrial IoT into industrial systems, distributed control systems, and industrial database systems. It describes privacy protection for sensor, control, and query data, while identifying several industrial applications that remain underexplored.

  • INTERNET OF THINGS: Differential privacy in IIoT is organized into industrial systems, distributed control systems, and industrial database systems.The framework is presented as a classification of IIoT privacy-preservation applications.
  • INTERNET OF THINGS: Differential privacy is presented as a suitable approach for communicating industrial sensor data without compromising data integrity and privacy.One surveyed method combines differential privacy with k-anonymity to enhance data anonymization.
  • INTERNET OF THINGS: Gaussian-noise mechanisms preserve real-time floating data between distributed-control devices while improving reported performance, privacy, and attack resiliency.The surveyed methodologies calculate the minimum Gaussian noise required to ensure system privacy.
  • INTERNET OF THINGS: Differential privacy enables companies to execute queries over perturbed industrial databases without risking users’ data.The survey identifies privacy protection for data mining, machine learning, and industrial auctions as future areas.

A. Energy Systems Issues and Research Directions

Smart-grid applications create privacy challenges when detailed energy data supports billing, energy trading, firmware updates, and resource-constrained communication. The survey highlights unresolved needs for differential privacy in several energy-system scenarios.

  • A. Energy Systems Issues and Research Directions: Dynamic-pricing billing requires detailed consumption information that can leak smart-meter users’ private data.The survey identifies simultaneous privacy preservation and accurate billing as a research challenge.
  • A. Energy Systems Issues and Research Directions: Renewable-energy auctions in smart homes can expose buyer and seller identities, and this application remains unaddressed in the literature.The survey calls for differential privacy techniques to secure this auction mechanism.
  • A. Energy Systems Issues and Research Directions: Smart-meter firmware updates require secure, private communication and selective access control for particular groups of meters.The survey suggests combining differential privacy with encryption, while noting that existing work has focused on security approaches.
  • A. Energy Systems Issues and Research Directions: Resource-constrained micro-grids use lossy networks that are vulnerable to adversaries and privacy attacks.The passage links unreliable communication with potential privacy loss and related crimes.
  • A. Energy Systems Issues and Research Directions: Smart transportation systems must improve communication and service quality while addressing privacy and security issues in connected vehicles and live traffic data.Live route-planning feeds can threaten the location privacy of connected devices and cars.

2) Vehicle-to-Vehicle (V2V) Communication:

The paper discusses differential privacy applications across healthcare, industrial systems, big-data challenges, and future research directions in CPS privacy.

  • Body Sensors Data: Differential privacy can support privacy-preserving real-time reporting for body-sensor data, but implementation on low-memory microcontrollers remains challenging.The cited discussion identifies noise addition on small microcontrollers as a central practical challenge.
  • Healthcare Systems: Healthcare devices in elderly homes require privacy protection because monitoring data can expose sensitive information.
  • Industrial Systems: Industrial IoT improves autonomous control, data storage, and communication while introducing risks to industrial data and machinery.
  • Industrial Systems: Differential privacy is presented as a suitable approach for protecting privacy on third-party industrial auction platforms.
  • Big Data: Big-data privacy research still faces challenges in intuitive privacy definitions, optimal privacy-budget composition, dimensionality, and computation overhead.The survey also identifies local, concentrated, w-event, and Bayesian differential privacy as future directions.
  • Machine Learning: Privacy-preserving machine learning remains challenging when extracting information from sensitive data such as medical records.

2) Machine Learning:

The paper connects cloud, edge, blockchain, game-theoretic, and differential-privacy approaches to privacy challenges in data-intensive CPS applications.

  • Cloud Computing: Cloud computing offers on-demand storage and computation, but outsourcing CPS data creates privacy risks and encrypted processing can be computationally complex.
  • Edge Computing: Wireless edge-computing networks contain private data that cannot be sent directly for prediction and processing.
  • Blockchain: Blockchain is described as a decentralized storage strategy adopted across healthcare, finance, and logistics, motivating integration with other technologies.
  • Game Theory: Game theory can analyze competing participants and many scenarios, including smart-grid energy trading, while also addressing security and privacy.
  • Differential Privacy in CPSs: The survey covers differential-privacy implementation across energy, transportation, healthcare, and industrial CPS applications.
Loading 1812.02282v3…