web counter

My research interests are in the area of security and privacy of computer and communication systems, with application areas such as wireless networks, Internet of Things and mobile devices. More specific research topics include: wireless physical-layer security, security of next-generation networks, privacy-preserving data mining, location privacy, and automated privacy protection.

1. Automated Privacy Protection for Mobile Devices

The pervasiveness of mobile devices with always connected users fostered applications that rely on user data to provide personalized services. However, privacy risks arise from the continuous access and collection of user data, that is sometimes sold and/or shared with third parties, e.g. through data brokers. One of the underlying issues is with the lack of awareness and control of users with respect to the privacy settings of mobile devices.

The multitude of apps and privacy configurations make it unfeasible to finely control all privacy settings. In particular in a field-study [1] we observed an average of 836 permission requests per day (around 35 per hour), thus making it impractical to manually answer all requests. Therefore, current approaches rely on a paradigm where generally permissions are asked upon first use, but automatically granted on all subsequent requests. This is, however, a suboptimal privacy approach, that leads to 15% of privacy violations [1].

It is well known that users trade privacy for small benefits (e.g. "free" services). This calls for mechanisms that empower users with greater control and awareness over their data.

Our work addresses this issue through the development of mechanisms for automated privacy protection. For example, prediction of privacy preferences allows to reduce the number of privacy violations [2]. Such prediction can also be performed in a distributed / federated manner [3], thus enabling prediction of privacy decisions without access to user data.

Part of this work was performed in the scope of the NGI-TRUST project COP-MODE and the MIT-Portugal project SNOB5G.

Related references:
[1] R. Mendes, A. Brandao, J.P. Vilela, A.R. Beresford, Effect of User Expectation on Mobile App Privacy: A Field Study, International Conference on Pervasive Computing and Communications (PerCom), 2022
[2] R. Mendes, M. Cunha, J.P. Vilela, A. Beresford, Enhancing User Privacy in Mobile Devices Through Prediction of Privacy Preferences, European Symposium on Research in Computer Security (ESORICS), 2022
[3] A. Brandao, R. Mendes, J.P. Vilela, Prediction of Mobile App Privacy Preferences with User Profiles via Federated Learning, ACM Conference on Data and Application Security and Privacy (CODASPY), 2022

2. Location Privacy

Location-Based Services (LBSs) proliferate with the pervasiveness of mobile devices (e.g. smartphones) and their connectivity. While useful to the user, sharing location data with service providers raises privacy concerns that are beyond physical safety. Specifically, it is known that location data may reveal identity, habits, health conditions and social connections, even if data is anonymized.

Together with the above challenges, the specific characteristics of location data, namely the correlation of location traces and their collection frequency, requires tailored privacy solutions. While vast, the research on location privacy has fallen behind this development, specially in Location Privacy-Preserving Mechanisms (LPPMs) that act at collection time.

In this topic, we analyze the effect of correlations [1, 3] in location traces on the privacy level attained by current state of the art solutions such as Geo-Indistinguishability. With the obtained knowledge, we proposed a novel privacy-preserving mechanism for location traces that resorts to clustering [2] of nearby locations to avoid correlation attacks. We further propose a method that provides an automatic and dynamic trade-off between privacy and utility accordingly to the velocity of the user and the frequency of reports [4]. These protection methods as well as attacks over location data have been implemented and made available to the community through our Privacy Toolkit [5], available here: https://privkit.fc.up.pt/.

Related references:
[1] On the Effect of Update Frequency on Geo-Indistinguishability of Mobility Traces, R. Mendes, J.P. Vilela, ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), 2018.
[2] Clustering Geo-Indistinguishability for Privacy of Continuous Location Traces, M. Cunha, R. Mendes, J.P. Vilela, IEEE International Conference on Computing Communication and Security, 2019
[3] Impact of Frequency of Location Reports on the Privacy Level of Geo-indistinguishability, R.Mendes, M.Cunha, J.P.Vilela, Proceedings on Privacy Enhancing Technologies (PETS), 2020.
[4] Velocity-Aware Geo-Indistinguishability, R. Mendes, M. Cunha, J.P. Vilela, ACM Conference on Data and Application Security and Privacy (CODASPY), 2023
[5] Privkit: A Toolkit of Privacy-Preserving Mechanisms for Heterogeneous Data Type, M. Cunha, G. Duarte, R. Andrade, R. Mendes, J.P. Vilela, ACM Conference on Data and Application Security and Privacy (CODASPY), 2024

3. Physical-layer Security

Jamming for Secrecy:

Coding and Modulation for Secrecy:

4. Other Networking Security (Ad-hoc Networks, Network Coding, Cloud, IoT, SDN)