Knowledge elicitation methodology for evaluation of Internet of Things privacy characteristics in smart cities

One of the impediments to transforming urban cities into smart cities is the security and privacy concerns that arise due to use of Internet of Things (IoT) devices in various smart city applications. While IoT device vendors publish their security and privacy policies, manual evaluation of these policies is tedious and prone to misinterpretation as there is a lot of variability in the language used across IoT vendors. Local administrations and policy analysts are faced with understanding the implications of integrating IoT devices with differing security and privacy characteristics but lack methods that support them in analysis of privacy characteristics from a holistic perspective. In this paper, a methodology for knowledge elicitation from textual information is outlined to evaluate privacy characteristics of IoT devices. The methodology includes natural language processing and deep learning techniques to evaluate the relevance of IoT privacy policies to the National Institute of Standards and Technology (NIST) security and privacy framework ⁵. Based on the analysis, text similarity scores are calculated for each IoT privacy policy document and each section of the policy document is labeled to NIST categories and functions. Analysis of these resulting labels and scores helps analysts to gain insights on each privacy policy as well as provide a holistic perspective of the privacy characteristics of IoT devices used in smart city applications. For example, all the policy documents used in the study talk about Protect domain and half of the documents cover Detect domain. However, most of the policies contain gaps regarding the Identify, Respond, and Recover domains. The study has implications for policy analysts, IoT vendors, and smart city administrators in terms of understanding the privacy gaps in IoT devices with respect to the NIST framework which can ultimately support policy alignment to address privacy concerns for smart cities.