MIT, Harvard researchers push new way for users to control access to personal data

Called Sieve, the approach could pose challenges to companies storing users' personal data and government searches

Cryptography researchers at MIT and Harvard have developed software called Sieve that is designed to help users keep track of encrypted personal data and better manage it in the cloud.

The Web infrastructure concepts behind Sieve could have significant implications for government searches of data, such as in the Apple-FBI case, or for companies using personal data from fitness bands and other devices for marketing and other purposes.

With Sieve, a Web user on a smartphone, smartwatch or other device could store personal data in encrypted form in the cloud, according to an MIT statement on Friday.

Then, when any app wants to use specific data items, like a name or address, it would send a request to the user, and, if granted, would receive a secret key to decrypt only those items kept in the cloud account of the user. In addition, if the user wanted to revoke the app's access, Sieve would re-encrypt the data with a new key.

The idea for Sieve first came more than a year ago to Frank Wang, a Ph.D candidate in computer science at MIT. Wang was using his Fitbit and was concerned about where his fitness data was stored and how it would be accessed by him or by others, he said in an interview. "I don't want people to hack my data and get more than I want," he said.

"With Sieve, we want users to securely store and selectively access that data for Web services and Web apps. We want the data to remain secure and give subsets to Web services. In theory that's easy, but in practice, it's difficult," Wang said. "With Sieve, the user has more control over how his or her data flows to different parties."

Wang spoke by phone just prior to giving a talk on Friday about Sieve at the Usenix Symposium on Networked Systems Design and Implementation on Santa Clara, Calif. Wang, 26, has worked to develop Sieve with MIT associate professors of electrical engineering and computer science Nickolai Zeldovich and Vinod Vaikuntanathan as well as James Mickens, associated professor of computer science at Harvard University.

Apps used on everything from smart thermostats to smartphones "collect a lot of user data, and you don't know what the [app developer] will do with it," Wang said. "Our goal is to say it's the users' data, and they should say how it's used."

He gave one practical example of how Sieve would work. If a sleep monitor has sleep data that is better than what a fitness band could provide, a user could permit the sleep data to be ported to the fitness band, which might give better tips on fitness than the sleep monitor would provide. "It makes it very easy with all the data in one location," Wang said.

"Part of my motivation for Sieve was that fitness data may need to be regulated, since how different, really, is fitness data from medical records? " Wang said. "People can guess a lot about my health with a small amount of data."

Concerns about uses of fitness data and other seemingly innocuous information have come to the attention of the Federal Trade Commission and other regulators. During an appearance at CES in January, FTC Chairwoman Edith Ramirez said that devices are "gathering increasingly sensitive information about us and how it is used or shared, and the potential for unintended uses is a concern."

Ramirez said she was so personally concerned about sharing her own fitness data that she uses an older, unconnected pedometer to measure her steps. "I don't want to share," she said.

Sieve could also better protect a person's data from a court-ordered warrant. If the FBI brought a search warrant to Facebook or Amazon for a person's data, the companies would be able to say that they don't have any of the user's important data. "If somebody told Amazon, give me all of Frank's data, Amazon can say, 'Ask Frank,' " Wang said.

Wang is well aware of the FBI-Apple dispute in federal court over gaining access to a secure iPhone used in a terror attack. "Maybe Sieve would raise the hackles of the intelligence community, I don't know," Wang said.

But Sieve could be a means to simplify things for users, he said. In another example, he said a user signing up with a new insurance company could give the insurer a specific key to access a subset of the user's personal data in the cloud. After the access was finished, the key would be changed to prevent further access.

While part of the idea for Sieve came out of Wang's concerns over his personal data on Fitbit, it also came from the latest direction of study in the computer science field. "A lot of people in computer science are excited by users managing their own data, instead of Web services doing it," Wang said.

"There's a lot of user distrust about using Web services and the cloud and finding some way to interact in a secure way," he said. "People are concerned about privacy and many don't know that Facebook and Fitbit have a lot of data on us."

Wang received his undergraduate degree in computer science at Stanford University. He envisions three components for Sieve: software that a user installs on a device, software installed on apps and software installed in the cloud.

"It would be great if Sieve was a product, but it's more of a model of a new Web infrastructure," he said. Meeting with tech companies and app developers will help determine the path forward for Sieve.

"All of this is about making data access seamless for users," he said. "I hate the way we get data from Web services."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Show Comments

Latest Videos

Conversations over a cuppa with CMO: ABC's Leisa Bacon

In this episode of Conversations over a Cuppa with CMO, ABC's director of audiences, Leisa Bacon, shares how she's navigated the COVID-19 crisis, the milestones and adaptability it's ushered in, and what sustained lessons there are for marketers as we start to recover.

More Videos

Remote working has gained a lot of attention in the past few months. And the key driver to the smooth workflow of remote working is obvio...

varun

How to manage social media during Covid-19

Read more

Hi everyone! Hope you are doing well. I just came across your website and I have to say that your work is really appreciative. Your conte...

Rochie Grey

Will 3D printing be good for retail?

Read more

Zero proof spiritsUsa since 2011 www.arkaybeverages.com🤪🤟

Sylvie

How this alcohol-free spirits brand rode the health and wellness wave

Read more

okay this a good newsmaybe i gonna try it

kenzopoker1

CMO's top 8 martech stories for the week - 9 July 2020

Read more

Very insightful. Executive leaders can let middle managers decide on the best course of action for the business and once these plans are ...

Abi TCA

CMOs: Let middle managers lead radical innovation

Read more

Blog Posts

Why CMOs need a clear voice strategy to connect with their customers

Now more than ever, voice presents a clear opportunity to add value to an organisation in many ways. Where operational efficiencies are scrutinised, budgets are tighter and discretionary consumer spend at a low, engaging with an audience is difficult.

Guy Munro

Head of innovation and technology, Paper + Spark

MYOD Dataset: Building a DAM

In my first article in this MYOD [Make Your Organisation Data-Driven] series, I articulated a one-line approach to successfully injecting data into your organisation’s DNA: Using a Dataset -> Skillset -> Mindset framework. This will take your people and processes on a journey to data actualisation.

Kshira Saagar

Group director of data science, Global Fashion Group

Business quiet? Now is the time to review your owned assets

For businesses and advertiser categories currently experiencing a slowdown in consumer activity, now is the optimal time to get started on projects that have been of high importance, but low urgency.

Olia Krivtchoun

CX discipline leader, Spark Foundry

Sign in