Isaac Agudo

Ali El Kaafarani

David Nuñez
email: dnunez@lcc.uma.es

Siani Pearson
email: siani.pearson@hp.com

Ali El Kaafarani
email: ali.elkaafarani@maths.ox.ac.uk

A Technique for Enhanced Provision of Appropriate Access to Evidence Across Service Provision Chains

Keywords: accountability, attribute based encryption, auditing, cloud computing, proxy re-encryption

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

There are a variety of data protection concerns related to cloud computing that include ongoing questions of jurisdiction and exacerbation of privacy risk through sub-processing and de-localisation, as well as legal uncertainty 4 .

Auditing and verification of accounts by third parties are a necessary part of provision of accountability in complex service provision ecosystems, and the related building of trust [START_REF] Pearson | Accountability in cloud service provision ecosystems[END_REF]. However, the implementation of certain accountability measures themselves could introduce data protection risks, such as breach risks. For example, personal data would be included both in accounts and also in logs that are gathered for evidence. Hence, for both privacy and security reasons it is not the case that all actors should be able to see all logs, nor even that Work done while at Hewlett Packard Labs.

actors that may need to have a view on parts of certain logs in order to provide appropriate audit or verification should even be able to see all parts of those logs. This is the main problem that we address. In this paper we present and compare two novel approaches for controlling access to logs (or other forms of evidence that may be used when assessing accountability) and provide examples of their usage within cloud data transfer scenarios.

Specifically, we describe two cryptographic schemes which provide a finegrained access control mechanism to the logged data. The different actors may be authorised to have different views on relevant log files, in various ways. For example, data subjects may disclose their data to data processors based on a privacy policy which states how their data will be processed by data processors, and who can access its related log files that are possibly distributed across multiple log servers. A data subject should be always able to access data logged about his data, but (s)he might want to delegate this right to some auditing agents of his or her choice.

Related Work

In general, technical security measures (such as open strong cryptography) can help prevent falsification of logs, and privacy-enhancing techniques and adequate access control should be used to protect personal information in logs. More specifically, relevant techniques for addressing accountability in the context described above include non repudiable logs, backups, distributed logging, forward integrity via use of hash chains and automated tools for log audits; for example, a log analyser and framework that link obligations right through to lower level distributed evidence in cloud supply chains that show whether or not the obligations are met [START_REF] Chaum | Untraceable electronic cash[END_REF]. Core techniques from the field of secure logging are described in [START_REF] Bellare | Forward integrity for secure audit logs[END_REF] [START_REF] Bellare | Forward-security in private-key cryptography[END_REF] [START_REF] Schneier | Cryptographic support for secure logs on untrusted machines[END_REF]; the first paper about using chains of values of cryptographic hash functions for proofs of integrity dates from a paper about time-stamping by Stuart Haber and Scott Stornetta [START_REF] Haber | How to time-stamp a digital document[END_REF]. Closely related research related to secure logging for accountability has been carried out within Daniel Le Metayer's group in INRIA (for example [START_REF] Métayer | Designing log architectures for legal evidence[END_REF], [START_REF] Butin | Log design for accountability[END_REF]). While secure logging techniques mainly focus on integrity (for example via the use of hash chains), our research is concerned with access control in logging systems. Of course, there has been a great deal of work on various techniques for access control, including Role-Based Access Control (RBAC) techniques, protection of data during database query [START_REF] Agrawal | Hippocratic databases. In: Proceedings of the 28th international conference on Very Large Data Bases[END_REF], etc.

Our research provides contextual access to logs to governance actors (such as regulators) and other third parties. There is some analogous research carried out that instead takes a data subject centric approach, providing a transparencyenhancing tool for informing users about the actual data processing that takes place on their personal data [START_REF] O'hara | Transparent government, not transparent citizens: a report on privacy and transparency for the cabinet office[END_REF]. But the range of applications is therefore smaller. Some of the assumptions and techniques vary, although there are a number of strong similarities to that approach. Transparency Log (TL) [START_REF] Pulls | Distributed privacy-preserving transparency logging[END_REF] is a transparency enhancing tool that plays an essential role in the A4Cloud EU project 5 , namely, to facilitate the communication of data from data controllers to data subjects. In order to provide secrecy, TL uses an encryption scheme that is indistinguishable against chosen plaintext attacks (IND-CPA) (see [START_REF] Pulls | D:D-5.2 User-Centric Transparency Tools[END_REF]); however, using this type of encryption scheme, an entity has to encrypt multiple copies of the same data if it wants to send them to different recipients even if they are allowed to see the same subset of log information.

Our research relies on technical means to protect evidence, whereas there is other (potentially complementary) research that aims to improve transparency (for example, by exposing additional evidence to actors that can then be assessed). An example is the Cloud Security Alliance (CSA) Cloud Trust Protocol (CTP) 6 , which works at the transport interface layer and which allows cloud service consumers to ask for and receive information about "elements of transparency" from cloud service providers. Indeed, transparency is an important aspect of accountability [START_REF] Pearson | Accountability in cloud service provision ecosystems[END_REF]. At present, end users have an unequal relationship with service providers, exacerbated by current cloud providers offering "take it or leave it" terms of service: users have no bargaining power vis-a-vis cloud service providers and no means of verifying that cloud providers behave as they claim they do. Furthermore, this transparency should be provided in a way that does not impinge on privacy, especially since there can be tension between privacy and transparency [START_REF] O'hara | Transparent government, not transparent citizens: a report on privacy and transparency for the cabinet office[END_REF]. The Privacy by Design approach strives to reach a positive sum, which allows both privacy and accountability/transparency to be implemented [START_REF] Camenisch | Accountable privacy supporting services[END_REF]. Such a positive sum can be achieved by pseudonymity schemes with the help of cryptography which allow revocation of anonymity for misbehaving users, making them accountable for their actions while guaranteeing strong anonymity for honest users (see for instance [START_REF] Flegel | Privacy-respecting intrusion detection[END_REF][START_REF] Øverlier | Non-expanding transaction specific pseudonymization for ip traffic monitoring[END_REF]). Previous work has been done on pseudonymisation of log files [START_REF] Flegel | Evaluating the design of an audit data pseudonymizer using basic building blocks for anonymity[END_REF] for enhancing privacy of accountability tools, such as intrusion detection systems (see e.g. Revocable Privacy 7 ). Further related research on privacy aspects of transparency has been conducted by the Revocable Privacy project8 , the FIDIS [START_REF]Behavioural biometric profiling and transparency enhancing tools[END_REF], PrimeLife [START_REF].2 -end user transparency tools: Ui prototypes[END_REF][START_REF] Hedbom | Adding secure transparency logging to the prime core[END_REF] and A4Cloud EU projects.

There is a need for provenance logs for accountability, and yet there is a potential tension with privacy. This issue is not confined to cloud service provision chains, but is a broader issue that also relates to scenarios relating to internet of things, smart cities and so on, where there can be many logs reflecting what has been happening in the system. Quite often, to solve this problem, some degree of approximation could be introduced into the logs [START_REF] Flegel | Evaluating the design of an audit data pseudonymizer using basic building blocks for anonymity[END_REF], but data linkage could reduce any pseudonymisation used and make it obsolete. It is not clear what the noise added in should be, and how that should match the context (and especially the purpose of usage). Deciding how to structure the information and how to obfuscate it and which parts to obfuscate is non trivial and requires further research. Prior research in the area of data provenance9 needs to be combined with new privacy preserving methodologies. The approach described in this paper could potentially be combined with such an approach: our work addresses certain tensions between log access, accountability and privacy, given existing logs within a system, rather than addressing the generation of logs in an appropriate format or the provenance of such logs.

The logs that are protected may relate to data creation, access, flow, type, deletion or handling [START_REF] Rübsamen | Evidence for accountable cloud computing services[END_REF]. The proposed research is not dependent on particular means used to produce logs, and could build on top of logs produced by existing Security Information and Event Management (SIEM or SIM/SEM) solutions [START_REF] Nicolett | Critical capabilities for security information and event management technology[END_REF]. These include, for example, RSA envision10 and HP ArcSight11 , which provide a standardized approach to collect information and events, store and query and provide degrees of correlations, usually driven by rules. SIEM solutions do not cover business audit and strategic (security) risk assessment but instead provide inputs that need to be properly analysed and translated into a suitable format to be used by senior risk assessors and strategic policy makers. Risk assessment standards such as ISO 2700x12 , NIST 13 , etc. operate at a macro level and usually do not fully leverage information coming from logging and auditing activities carried out by IT operations. Similarly, there exist a number of frameworks for auditing a company's IT controls, most notably COSO14 and COBIT 15 .

Scenario

We consider the aspect of controlling access to the logs (and related accountability evidence) involved within cloud ecosystems. Accountability evidence can be defined as a collection of data, metadata, routine information, and formal operations performed on data and metadata, which provide attributable and verifiable account of the fulfilment (or not) of relevant obligations; it can be used to support an argument on the validity of claims about appropriate functioning of an observable system [START_REF] Agrawal | D:C-8.1 Framework of Evidence[END_REF]. Logging can be performed at different levels and evidence can have different sources as well [START_REF] Rübsamen | Evidence for accountable cloud computing services[END_REF]. In particular, at the data level we might be interested in: data creation, data access, data flow, data type, data deletion, data handling and data notification.

Since data that is collected for accountability might itself be data that can be abused, it might need to be protected as much as the processed data. The potential conflict of accountability with privacy is somewhat reduced as the focus in data protection is not on the accountability of data subjects but rather of data controllers, who need to be accountable towards data subjects and trusted intermediaries, and the identities of the service providers do not need to be hidden.

As discussed in Section 1, we consider the subproblem of how appropriate views may be provided to selected cloud stakeholders on logs and evidencerelated information. The overall scenario is shown in Figure 1, where governance actors, or indeed the cloud subjects or the cloud customers, may need to have a view on logs or other accountability evidence produced within the cloud ecosystem. In this figure we use the extension of the NIST cloud actor roles defined in the A4Cloud project, by which in a data protection context data subjects whose information is being processed in the cloud are relevant parties called cloud subjects. In addition, there may be an organisational cloud customer with the role of a data controller, there can be more than one cloud service provider, and accountability agents may be acting on behalf of the cloud customer or of data protection authorities (a form of cloud supervisory authority). The organisational cloud customer, and indeed the cloud service providers, will have their own internal business governance. For further details, see [START_REF] Pearson | Accountability in cloud service provision ecosystems[END_REF].

Rules need to be enforced about who may access what aspects of the logs. We require authorized entities that may be for example a cloud customer, their clients, data subjects, auditors, cloud service providers and regulators to be given different views on the logs and evidence derived from logs, in a way that satisfies data minimization. That is to say, such that they should be able to see only the source or derived data from logs that is necessary to provide the level of assurance that they need. Furthermore, this must be without revealing personal or other types of confidential information (either in the processed data, source data logs or evidence derived from these logs) that they do not need to see.

In some scenarios it might also be needed that governance actors that oversee the way that data is handled in the Cloud (for example as shown on the left hand side of Figure 1) delegate access to some parts of the logs in an accountable way. For example, an authorised cloud auditor might require the assistance of some other auditor. Instead of sharing the logs directly it would be preferable that access by the secondary auditor to the logs is also performed in an accountable way, subject to the same (or more constrained) rules as the primary auditor.

The specific requirements that are addressed by this scheme are as follows:

-R1 (Secrecy) Confidentiality of the logs regarding data processing, as parts of the logs may reveal personal or confidential data. -R2 (Fine-grained Access Control) Data should be structured in a way that makes it possible to give different views of the logs to different entities, without necessitating an all-or-nothing approach. -R3 (Audit) It should be possible to track access to the different views of the logs, namely recording in a trustworthy way who accessed what and when that happened.

Confidentiality of the personal and/or confidential data processed within the cloud service provision chain is of course a very important aspect too, but is not included in the requirements above as this problem is not the focus of our attention. Furthermore, the confidentiality of the logs regarding access to the data processing logs, i.e. auditing logs is in general much less of an issue than integrity requirements concerning those logs, so we do not here include it in R1.

Note that in our approach we are relaxing some of the security requirements defined in [START_REF] Pulls | Distributed privacy-preserving transparency logging[END_REF] as we leave some secure logging aspects (such as log integrity) to other well known techniques to address and we are not making the presumption that the logs are readable only by the associated data subject. For example, we are not covering Forward Integrity [START_REF] Bellare | Forward integrity for secure audit logs[END_REF], i.e the adversary should not be able to make undetectable modifications to logged data (committed prior to compromise). Another assumption we make in this paper is that cloud providers follow the honest-but-curious adversary model [START_REF] Smart | Cryptography: an introduction[END_REF], which means they follow the established protocols, but will try to access the protected information.

We will now discuss some particular solutions that address the above requirements.

Solutions

We propose an alternative solution to existing transparency logs [START_REF] Pulls | Distributed privacy-preserving transparency logging[END_REF] that overcome some of their previously identified issues, mainly the lack of flexibility when different auditing agents with different privileges or views are involved. Also, we allow the CSP to delegate to a logging module or some other component the task of granting access to different auditing entities.

We propose a transparency-enhancing tool in the form of a cryptographic scheme that enables data processors to control access to auditors, regulators, data subjects and other authorized parties to information about the data processing that is carried out within a service provision chain.

In this new approach, we deal with cases where data subjects might have a say in deciding who can play the role of an auditor, or simply when data controllers want to encrypt different levels of sensitive information presented in the logs once and yet allow more than one party to access different parts of them, based on their roles in the whole scenario. Figure 2 presents a generic diagram of our approach that shows the key components, namely, logging of the processing of personal and/or confidential data, access to those logs by authorised parties, and auditing about that data access, grouped in the following domains: -Log Generation Domain. This domain encompasses the logged system (i.e., CSP) and an associated Logging Service, which generates the logs regarding the processing of data and protects them according to an access policy, encrypting all entries of the log or some parts of them. Depending on the kind of approach we take we might need to also categorise logs based on their contents and decide what roles would have access to them.

-Log Storage Domain. This domain is in charge of storing encrypted logs, and more importantly, of providing and tracking access to these logs by authorised governance actors. We are generally agnostic as to the particular cloud storage service provided. The enforcement of access control policies is done in the Log Access Service component. In addition, for every access, there should be an audit log produced by the Access Tracking component, indicating who accessed what and when. -Log Access Domain. This domain involves the access to the logs by the governance actors (e.g., auditors), using a Log Access Client.

This architecture supports different implementations. We differentiate between two main strategies for instantiating our proposal:

-A priori or Agent centric. In the a priori approach we put the focus on the agents that can audit the log. We aim at providing a solution that can protect log entries based on who should be entitled to access them. This way, data is protected with some embedded access control policies before reaching the data storage. When using this approach, agents can directly access the protected data and consume it according to the embedded policies. -A posteriori or Data centric. In the a posteriori or data centric approach we put the focus on the log (or other evidence). We aim to provide a solution that can protect logs based on its content. This way, no policy is taken into account when protecting the log but dependent on the content, the level of protection will be different. When using this approach we need to provide an a posteriori mechanism for access control that will be enforced when requesting access to the log.

In the following section we introduce two implementation strategies for each of the approaches, but it would not be hard instead to implement hybrid approaches using any of the strategies. We also discuss pros and cons of both of them.

A Priori Approach: Attribute Based Encryption

A cryptographic technique which we can employ in order to provide both confidentiality and access control mechanisms is a suitable attribute-based encryption (ABE) scheme. For instance, one can use either of [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF][START_REF] Waters | Ciphertext-policy attribute-based encryption: An expressive, efficient, and provably secure realization[END_REF], knowing that in [START_REF] Parno | How to delegate and verify in public: Verifiable computation from attribute-based encryption[END_REF], they show how to construct a Verifiable Computation scheme with public delegation and public verifiability from any ABE scheme. On the other hand, Sahai and Seyalioglu provide in [START_REF] Sahai | Dynamic credentials and ciphertext delegation for attribute-based encryption[END_REF] an ABE scheme that enjoys both delegation of access rights and revocation of private keys. Similar to [START_REF] Pulls | Distributed privacy-preserving transparency logging[END_REF], data subjects in our approach can always have full access to data logged about their data. But now, they (or the data controllers) can delegate this right to some accountability agents.

All they need to do is to include them in the encryption policy part of the privacy policy. As an example of an encryption policy, one can think of the following boolean combination:

Ψ := (DataSubject) ∨ (AuditorLocation = EU) ∧ (BSI accredited)
Encrypting logs with respect to this policy means that the corresponding data subject can access the full data presented in the logs, but so can any auditor who is located in EU with a British Standards Institution (BSI) accreditation. Other encryption policies will be defined for potential accountability agents, to share the access of the same subset of metadata. Some scenarios would allow data subjects and data processors to agree on the full privacy policy when they start their negotiation (if there is any). The encryption policy could be then a part of the privacy policy.

Building blocks: ABE

Attribute-based Encryption was first presented to surpass one of the drawbacks of sharing encrypting data on the cloud; namely, we were able to share data only at a coarse-grained level; i.e by giving away a private key to whoever we want to share our data with. Attribute based encryption offers a way for finegrained sharing of encrypted data. Informally speaking, someone can encrypt his data with respect to a certain predicate (aka policy), and only people who have enough credentials to satisfy the predicate are granted access to the data.

In our approach we propose to use the Ciphertext-Policy variant of ABE (or CP-ABE). In this paradigm, encryption is done using a function Enc which takes a message m, the policy Ψ and any other public parameters PK established at the beginning of the protocol. The decryption key (which is issued by an attribute authority to entities satisfying policy Ψ or a suitable subset of that policy) is computed from the attributes A of the entity and the master key established at the beginning of the protocol. Once an entity has been issued a decryption key corresponding to its attribute set A, it can decrypt ciphertexts associated to policy Ψ . For illustrative purposes, the following is the generic syntax of a CP-ABE scheme:

- The important thing to note is that decryption can only succeed in such a scheme if the entity trying to decrypt satisfies the policy that has been specified for the ciphertext, namely, if the entity holds the attributes which are required. A given key can decrypt a particular ciphertext only if there is a match between the attributes of the ciphertext and that key.

Mapping/Integration

Using ABE as building blocks, the following are the main architectural components of our approach:

-Attribute Authority (AA). There are one or more of these entities, which deal with attribute management, i.e. issuing, revoking and updating users' attributes. They create and distribute secret keys that are associated with attributes. The AAs run KeyGen, which gives a user a set of secret keys corresponding to the attributes that s/he holds, and these are distributed to the appropriate entities. This process is likely to be integrated to some extent to existing business processes, some of which may be offline. It is important that the mechanisms by which the attributes are allocated, distributed and kept up to date can be trusted by other entities in the system, but some of this process is necessarily out of scope for the proposed architecture as it will vary across different scenarios and related infrastructures. -Trusted Authority (TA) (optional). Optionally, a central authority can be used, whereby all the users and attribute authorities in the system register with a central certification authority to obtain certificates, i.e. this entity underpins a PKI, distributing global secret and public keys. In an initial phase, the TA sets up the system by running Setup. Alternatively, a different approach can be taken by which this entity is not needed, and instead of the legal users in the system having public keys distributed by this entity, they have credentials corresponding to their attributes, issued by multiple attribute authorities. -Log Policy Manager (LPM). This deals with policy creation and modification aspects, as well as building of lists of standardized attributes for relevant domains, which may correspond to more than one attribute authority. -Logging Service (LS): This allows generation of a fresh symmetric key (e.g.

for AES) using a random number generator, encryption of log entries using said key and encryption of the symmetric key using ABE. This hybrid encryption is used to make the process more efficient, relative to encrypting potentially large data objects directly using ABE. More formally, for a given log entry i , LS generates a fresh symmetric key k i and encrypts it using ABE with respect to a policy Ψ , which results in the ciphertext c i,1 = Enc(PK, Ψ, k i ). The log entry is encrypted with k i using symmetric encryption, which produces c i,2 = SymEnc(k i , i ). Therefore, the hybrid encryption produces a pair (c i,1 , c i,2 ). Overall, LPM interacts with log owners to allow them to form/modify policies (using a standardised set of attributes for a given domain), and LS encrypts a symmetric key with this policy using ABE, that is used to encrypt the log entries and store them in the cloud storage. This component would run as a separate service, probably using the cloud storage service (CSS) to store encrypted policies and other customer related data needed for the functioning of the service (using keys generated by LS). -Log Access Client (LAC). This process involves decryption of the symmetric key using ABE as well as decryption of log entries using the symmetric key.

In response to an auditor request for access to the logs, LAC fetches the corresponding encrypted logs from CSS, and decrypts them using auditors' secret keys, if the auditor has enough attributes to satisfy the policy Ψ . The LAC is likely to be run as a separate service, optionally integrated with LS for business reasons. Figure 3 depicts the main components of this architecture. In addition, there can be optional integration with existing services (e.g. key storage service, authentication service).

The protocol has a setup phase and an operational phase; the purpose of the former is to establish all security parameters and to codify in machine-readable form the policy of the log owner with regards to access to its logs and encrypt a symmetric key that encrypts the log using that policy as an encryption key. The operational phase comprises the steps that are carried out in order to grant auditors access to certain logs in the cloud system in accordance with the policy that has been established in the setup phase, or subsequently modified (with associated re-encryption).

Finally, we note that we could replicate this pattern for the Tracking and Audit Access processes in case we also want to protect the audit logs.

Analysis/Assessment of level of fulfillment of requirements

The requirement R1 (Secrecy) is satisfied as long as we use an ABE scheme that achieves a proper security notion, such as IND-CPA or IND-CCA. The requirement R2 (Fine-grained access control) is met by encrypting different parts of the log with different policies. The requirement R3 (Audit) is fulfilled through the Access Tracking component in the Log Storage Domain, which records all access requests received by the Log Access Service.

The main advantage of this approach is that the log information does not need to be encrypted multiple times, each with the public key of the entity that is to be given access to this information, but instead just needs to be encrypted once. Also, the identity of the accessors does not need to be known in advance, so this suits scenarios where the role of an auditor that can access information (together potentially with other properties) is known, but the specific person holding this role (and satisfying any additional constraints) is not necessarily known in advance.

The main drawback of this approach relates to the necessity of a pre-phase in which attributes are distributed, and in which the actors distributing these attributes need to be trusted, as well as the attributes themselves needing to be standardised and understandable (across the actors that use them) as well as revocation mechanisms needing to be in place (although there are various options for this). In addition, if the policy relating to access changes, then the log information would need to be re-encrypted based upon that.

A Posteriori Approach: Proxy Re-Encryption

In this section we discuss an alternative approach based on Proxy Re-Encryption (PRE) [START_REF] Ateniese | Improved proxy re-encryption schemes with applications to secure distributed storage[END_REF][START_REF] Canetti | Chosen-ciphertext secure proxy re-encryption[END_REF], which is a type of asymmetric encryption that allows a proxy to transform ciphertexts under Alice's public key into ciphertexts decryptable by Bob; this transformation is called re-encryption. The main idea behind the use of PRE in our scenario is that the re-encryption process can be seen as a way of enforcing the access delegation decision, and therefore, it is an ideal place to implement the auditing capability (i.e., recording all access requests), such that it cannot be bypassed, since the re-encryption is necessary to access the information. First we propose a preliminary version using a regular PRE scheme, and next we extend this proposal to support the requirement of finegrained access control using a variant of PRE called Conditional PRE.

Building blocks: PRE, conditional PRE

As described before, PRE allows a proxy to re-encrypt ciphertexts intended for Alice into ciphertexts for Bob. In order to do this, the proxy is given a reencryption key rk A→B , which makes this process possible. It can be seen that Proxy Re-Encryption materialises the functionality of delegation of decryption rights. In this case, a delegator Alice can delegate decryption rights into a delegatee Bob, and a proxy can enforce such rights by means of re-encryption. The re-encryption key act as a token of delegation. Therefore, PRE is an ideal candidate for constructing an access control system where information is outsourced (e.g., the cloud).

In our scenario, the parties that are interested on accessing the encrypted information are the consumers of the accountability evidence, in the form of logs. These consumers include auditors, data protection authorities, and data subjects, among others. Logs are encrypted under the public key of the data owner (i.e., the CSP). The CSP will grant access to specific consumers by means of re-encryption keys, which will be handed to log servers. In turn, log servers will act as proxies, enforcing the access control through the re-encryption procedure. When an auditor requests access to some log, the log server will verify if s/he is authorised (i.e., the corresponding re-encryption key exist) and will re-encrypt the data to the consumers's public key. The log servers are then capable of recording all access requests. This solution can be extended to support a finer-grained access control using Conditional Proxy Re-Encryption (CPRE) [START_REF] Weng | Conditional proxy reencryption secure against chosen-ciphertext attack[END_REF][START_REF] Weng | Efficient conditional proxy re-encryption with chosen-ciphertext security[END_REF]. CPRE is a specialization of PRE, where ciphertexts are tagged during decryption with a keyword (the "condition"); similarly, re-encryption keys are also tagged with a condition when they are generated, so only ciphertext tagged with the same condition is reencryptable by that key. Therefore, for a given ciphertext CT A with condition w, originally encrypted under A's public key, the proxy can only re-encrypt the ciphertext to user B if he has the re-encryption key rk A w →B . Using CPRE, the data owner can provide finer-grained access by means of a set of re-encryption keys with different conditions. The extension is essentially identical to the basic proposal, but ciphertexts (i.e., logs) are tagged during encryption with a specific condition (e.g., "contains personal information"). The proxies will be able to re-encrypt encrypted logs (or not) depending on whether they have the corresponding re-encryption keys. For the sake of completeness, we show here the generic syntax of a CPRE scheme:

-Setup(1 λ ): For a given security parameter, it computes a set of global parameters params.

-KeyGen(params): It computes a pair of public and private keys (pk i , sk i ).

-Enc(pk, w, m): For a given public key pk and a message m, it computes a ciphertext CT tagged with keyword w. -Dec(CT, sk): It decrypts a ciphertext CT for a given private key sk.

-ReKeyGen(sk i , w, pk j ): For a given private key sk i , a keyword w, and a public key pk j , it computes a conditional re-encryption key rk i w →j . -ReEnc(CT i , rk i w →j ): Using conditional re-encryption key rk i w →j , it re-encrypts a ciphertext CT i , encrypted under pk i and keyword w, into a ciphertext CT j decryptable by sk j .

Mapping/Integration

In order to deploy a CPRE-based access control system for logged data, it is necessary to agree first on a set of public parameters, generated by the Setup algorithm. Next, interested parties should possess a keypair, generated by the KeyGen algorithm; these parties not only include data consumers (e.g., auditors), but also the data owner. Based on off-line authorisation decisions, the data owner can grant access to data consumers using the ReKeyGen algorithm, producing re-encryption keys that act as authorization tokens; additionally, in the Conditional PRE setting, a condition tag will be associated during this process. These re-encryption keys are handed to the log servers, which will act then as re-encryption proxies, enforcing access control. Finally, data consumers can read the encrypted data using the Dec algorithm.

Figure 4 depicts our approach based on the use of Conditional Proxy Re-Encryption. The architecture is similar to the ABE-based one, but using CPRE for the encryption and decryption of logs; consequently, the components are adapted here to this cryptosystem. A fundamental difference, however, is that the CSS now provides a Log Access Service (LAS), which implements the reencryption functionality. It can be seen that this approach can be easily mapped to the elements shown in Figure 2, which depicts CSP internals. In this case, the functionality of log servers, which act as re-encryption proxies, is twofold: on the one hand, they enable log access through the re-encryption procedure; on the other hand, since they control re-encryption they can record access control requests in order to support tracking and audit access. In order to make the reencryption possible, it is necessary that the system logs generated on the CSP side are encrypted under its own key, so it can be re-encrypted to the consumer's public key.

Analysis/Assessment of level of fulfillment of requirements

Requirement R1 (Secrecy) is clearly fulfilled by using this approach. As with any public key encryption scheme, the idea is to use a hybrid encryption approach, where data is encrypted with a symmetric scheme under fresh random keys, and then these keys are encrypted with the PRE scheme. This way logged data is stored encrypted and the corresponding keys are only provided to authorised entities using public key cryptography.

In this paper, we presented two different transparency-enhancing mechanisms that support provision of appropriate views on audit logs, based on the use of Attribute-Based Encryption (ABE) and Conditional Proxy Re-Encryption (CPRE). These approaches provide confidentiality of logs with respect to unauthorized users, and fine-grained access control over the information about the data processing that is carried out within a service provision chain (although CPRE is more limited than ABE with respect to the satisfaction of this requirement). In both approaches, different cloud actors (e.g, auditors, regulators, data subjects and other authorised parties) may be given different views of the logs.

As further work, we plan to document more fully how these schemes would work, and assess in more detail related security aspects. In addition, we are considering the potential use of yet another advanced cryptographic technique, i.e. multi-party computation, in the context of transparency logging. Briefly, secure multi-party computation can be defined as follows [START_REF] Cramer | General secure multi-party computation from any linear secret-sharing scheme[END_REF]: n players want to compute a function of their private inputs in a secure way, i.e. it should guarantee both the correctness of the output and the privacy of the players' inputs, even when some players cheat. In this case, we consider a scenario in which different accountability agents have access to different levels of sensitive information presented in a certain transparency log. Bar the data subjects, we assume that none of the accountability agents has access to the full log. In this case, we want these agents to be able to work together in order to tell whether or not there is any breach, i.e. a given service provider is compliant with the privacy policy on which he agreed with a certain data subject. This can assure that no single auditor knows all the sensitive information about some data subjects. This clearly is not a trivial task, and therefore it can be considered as an intriguing idea for some future work that needs more investigation on many levels; first, to fully understand the way the current logs are formed and how flexible they are in the sense that if a certain log is divided into different chunks, how would the absence of at least one of them help in providing further protection of the privacy of the data subjects? Second, to study the practicality of current multi-party computation (MPC) systems because MPC is a complicated cryptographic tool and extra care must be taken to give an estimate of its impact on the practicality of the whole system.

Fig. 1 .

 1 Fig. 1. High level overview of the scenario

Fig. 2 .

 2 Fig. 2. Domains and processes in our solution

  Setup(1 λ , U ): For a given security parameter, it generates a set of global parameters, represented by PK, and the set of attributes U . The global parameters include the master key MSK. -Enc(PK, Ψ, m): The encryption function takes as input the message m, the public key PK and an encryption policy Ψ , and produces a ciphertext CT . -KeyGen(MSK, A): Taking as input the master secret key MSK and a set of attributes A, it creates the private key SK A associated to A. -Dec(CT, SK): The decryption function takes as input a ciphertext CT and a private key SK for a set A. If A satisfies the encryption policy associated to CT , then this function returns the original message m.

-

  Revocation Manager (RM): This component handles revocation and delegation. This may be handled in a number of different ways (e.g. time windows, revocation lists or more advanced techniques) and is the subject of further research which mechanisms would be most appropriate in the context of the project. Depending upon the decision about which one is chosen, aspects related to revocation may be integrated within the TA or AC, or run as a separate service.-Cloud Storage Service (CSS): This entity stores encrypted logs, and provides them to governance actors (e.g., auditors) by means of a Log Access Services (LAS).

Fig. 3 .

 3 Fig. 3. ABE-based architecture

European DG of Justice (Article 29 Working Party): Opinion 05/12 on Cloud Computing (2012).

http://www.a4cloud.eu/

https://cloudsecurityalliance.org/research/initiatives/cloud-trust-protocol

http://www.cs.ru.nl/ jhh/revocableprivacy/

http://www.fidis.net/fileadmin/fidis/deliverables/fidiswp7-del7.12 behaviouralbiometric profiling and transparency enhancing tools.pdf

See for example http://workshops.inf.ed.ac.uk/tapp2015/

http://www.rsa.com/experience/envision/3n1/

http://www.arcsight.com/

http://www.27000.org/

http://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf

http://www.coso.org

http://www.isaca.org

Acknowledgements

The research leading to these results has received funding from the European Union Seventh Framework Programme (FP7/2007-2013) under grant agreement n • 317550 (A4Cloud) and by the Junta de Andalucía through the project FIS-ICCO (P11-TIC-07223). The third author has been funded by a FPI fellowship from the Junta de Andalucía through the project PISCIS (P10-TIC-06334).

Logging Service

It can be seen that this approach for access control partially supports requirement R2 (Fine-grained access control). Using a conditional PRE scheme we can discriminate which data to grant access to (i.e., produce different logs views) and with the issuance of the corresponding re-encryption keys we can also decide who will have access to the different views of the logs.

We require that log servers perform a cryptographic operation on logs in order to ultimately grant access to other parties based on the existence of the corresponding re-encryption key. This forces us to place some extra burden on the log servers compared to the approach using ABE but on the other hand, when implemented properly, e.g., using some trusted module, it makes it easier to audit or track the actual of access to the logs because the log server is in the position of tracking access to the stored logs, by recording the re-encryption requests from auditors, supporting in this way requirement R3 (Audit). The idea is that the same module in charge of re-encrypting will do the audit as an atomic operation. This process can even be implemented in a trusted platform module (TPM) in order to increase reliability.


Michael Friedewald
email: michael.friedewald@isi.fraunhofer.de

Marc Van Lieshout

Sven Rung
email: sven.rung@isi.fraunhofer.de

Marc Van Lieshout
email: marc.vanlieshout@tno.nl

Modelling the Relationship Between Privacy and Security Perceptions and the Acceptance of Surveillance Practices

Keywords: Privacy, Public opinion, Security, Trade-off

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The relationship between privacy and security has often been understood as a zero-sum game, whereby any increase in security would inevitably mean a reduction in the privacy enjoyed by citizens. A typical incarnation of this thinking is the all-too-common argument: "If you have got nothing to hide you have got nothing to fear". This trade-off model has, however, been criticised because it approaches privacy and security in abstract terms and because it reduces public opinion to one specific attitude, which considers surveillance technologies to be useful in terms of security but potentially harmful in terms of privacy [START_REF] Pavone | Public assessment of new surveillance-oriented security technologies: Beyond the trade-off between privacy and security[END_REF][START_REF] Daniel | Understanding privacy[END_REF]. Whilst some people consider privacy and security as intrinsically intertwined conditions where the increase of one inevitably means the decrease of the other. There are also other views: There are those who are very sceptical about surveillance technologies and question whether their implementation can be considered beneficial in any way. Then there are people who do not consider monitoring technologies problematic at all and do not see their privacy threatened in any way by their proliferation. Finally there are those who doubt that surveillance technologies are effective enough in the prevention and detection of crime and terrorism to justify the infringement of privacy they cause [START_REF] Kreissl | Surveillance: Preventing and detecting crime and terrorism[END_REF].

Insight in the public understanding of security measures is important for decision makers in industry and politics who are often surprised about the negative public reactions showing that citizens are not willing to sacrifice their privacy for a bit more potential security. On the back of this the PRISMS project aimed to answer inter alia the question: When there is no simple trade-off between privacy and security perceptions, what then are the main factors that affect the perception and finally acceptance of specific security technologies, of specific security contexts and of specific security-related surveillance practices?

The PRISMS project has approached this question by conducting a largescale survey of European citizens. In [START_REF] Friedewald | Privacy and Security Perceptions of European Citizens: A Test of the Trade-off Model[END_REF] we have shown that privacy and security attitudes of European citizens are largely independent from one another. Now we are exploring what factors are influencing citizens' perception towards surveillance-based security practices. This is, however, not simply a matter of gathering data from a public opinion survey, as such questions have intricate conceptual, methodological and empirical dimensions. Citizens are influenced by a multitude of factors. For example, privacy and security may be experienced differently in different political and socio-cultural contexts. In this chapter, however, our focus will be on the survey results, not their interpretation from different disciplinary perspectives.

Theoretical approach

Researchers investigating the relationship between privacy and security have to deal with the so-called privacy paradox [START_REF] Dienlin | Is the privacy paradox a relic of the past? An in-depth analysis of privacy attitudes and privacy behaviors[END_REF]: It is well known that while European citizens are concerned about how the government and private sector collect data about citizens and consumers, these same citizens seem happy to freely give up personal and private information when they use the Internet. This "paradox" is not really paradoxical but represents a typical value-action gap, which has been observed in other fields as well [START_REF] Friedewald | Privacy and Security Perceptions of European Citizens: A Test of the Trade-off Model[END_REF]. 3

Social facts

Measuring privacy and security perceptions thus has to deal with problems similar to ecopsychology at the beginning of the environmental movement in the 1970s: What is the relationship between general values and concrete (environmental) concerns and how do they translate into individual behaviour? In PRISMS we have been inspired by the "theory of planned behaviour" (TPB) that suggests that if people evaluate the suggested behaviour as positive (attitude), and if they think their significant others want them to perform the behaviour (subjective norm), this results in a higher intention and they are more likely to behave in a certain way (fig. 1).

Fig. 1. Model of "planned behaviour" [1, p. 194] TBP is a positivist approach as it assumes that there are rules structuring the way people think and these "social facts", as Emile Durkheim has been calling them, can be verified by scientific observation and experimentation [START_REF] Durkheim | The Rules of Sociological Method[END_REF]. We assume that privacy and security perceptions of human being are such social facts and that they can be explained by other attributes (variables) on an aggregated level. We are aware of the fact that this assumption has been criticised by other epistemological perspectives such as critical school, cultural studies and STS, which are highlighting that attitudes and values may be situationally determined rather than stable dispositions and that a number of context factors may limit individual choice [START_REF] Cook | Taking a Position: A Reinterpretation of the Theory of Planned Behaviour[END_REF]. On the other hand a high correlation of attitudes and subjective norms to behavioural intention, and subsequently to behaviour, has been confirmed in many studies [START_REF] Ajzen | The Influence of Attitudes on Behavior[END_REF].

Operationalisation of central concepts

As a consequence the PRISMS survey comprises of questions exploring respondents' perceptions of privacy and security issues as well as values questions including political views, attitudes to rights and perceptions of technology. For the operationalisation of the central concepts we rely on the privacy typology by Finn et al. [START_REF] Finn | Seven types of privacy[END_REF] and a security typology by Lagazio [START_REF] Lagazio | The evolution of the concept of security[END_REF], each distinguishing seven different dimensions. These typologies could be used to design batteries of questions to address the wide spectrum of meanings of privacy and security.

To address this ambiguity and context dependence of the central concepts the PRISMS survey is working with so called vignettes that are used when survey respondents may understand survey questions in different ways, due to the abstractness of the presented concepts (privacy, security), their complexity (security technologies and practices) and because they come from different cultures.

Vignettes translate theoretical definitions of complicated concepts in presenting hypothetical situations and asking respondents questions to reveal their perceptions and values [START_REF] Pavlov | Application of the Vignette Approach to Analyzing Cross-Cultural Incompatibilities in Attitudes to Privacy of Personal Data and Security Checks at Airports[END_REF]. We have developed eight different vignettes (very short narratives of 50 to 100 words) presenting different types of security situations and surveillance technologies. 4 They are also covering all dimensions of privacy and security. For each of the vignettes citizens were asked if they think that the respective security-oriented surveillance practice should be used ("acceptance") and to what extend these practices threaten people's rights and freedoms ("intrusiveness").

Questionnaire and variables

For our research question we have modified and extended the general TBP model (see fig. 2) that includes demographic and structural factors and already suggests some interrelationships between the model elements [cf. 20, 4, 24, for similar attempts]

Fig. 2. Suggested relationships between variables explaining privacy and security perceptions and acceptance of security practices

The questionnaire used for the fieldwork thus did not only ask for an assessment of the central concepts privacy and security and of the acceptability and perceived intrusiveness of different security oriented surveillance practices but also those variables needed for the model: Individual characteristics: Age, gender, education, political orientation, geographic area (country, region), employment status, trust in people, attitude towards the benefits and risks of science and technology, member of a minority (self assessment) Experience, behaviour: Intensity of Internet use, experience with privacy invasions, experience with privacy preserving measures, perceived intrusiveness of security practice Knowledge: Privacy and data protection knowledge Interim target variables: Trust in institutions, security perceptions, privacy perceptions Final target variable: Vignette acceptance

Fieldwork

Fieldwork took place between February and June 2014. The survey company Ipsos MORI conducted around 1,000 30-minute phone interviews in all EU member states except Croatia (27,195 in total) amongst a representative sample (based on age, gender, work status and region) within each country. For economic reasons each interviewee was presented only four randomly selected vignettes, resulting in approx. 13,600 responses for each vignette (500 per country). 53 Empirical Results

Concept and methodology

Structural equation modelling (SEM) is a method used to study the relationship among multiple outcomes involving latent variables. In this respect SEM is similar to the regression models that were used to test if linear correlations exist between the different variables. However, SEM allows to estimate and test direct and indirect effects in a more complex system of regression equations and verify (or falsify) theories about the absence of relationships among latent variables [START_REF] Kaplan | Structural Equation Modeling: Foundations and Extensions[END_REF]. For instance, for the development of the SEM we tested the direct influence of demographics variables such as age on the constructs such as privacy and security perceptions and on the acceptance of the vignettes but also the indirect influence of the demographic variable on the acceptance via the constructs.

The main task in the development of a SEM is to reduce the large number of possible connections between the variables by deleting connections that do not show a statistically significant impact on the target variable. This is done iteratively until a number of benchmarks indicate a good model fit. 6 The model explores the relationship between the different variables to explain which variables influence the acceptance or rejection of surveillance based security practices as outlined in the scenarios. On the highest level the model does no longer distinguish between the vignettes, neither between virtual and physical forms of surveillance nor between public and private operators. Even with these generalisations or simplifications the resulting model is rather complex; it includes 17 variables with more than 40 significant correlations. However, the coefficient of determination R 2 , that indicates that the fraction by which the variance of the errors is smaller than the variance of the dependent variable. In our case the target variable "acceptance of surveillance oriented security measure" shows R 2 = 0.484, which means that almost half of the variability can be explained though the other variables in the model. This is a good value comparable to similar studies such as [START_REF] Blinkert | Unsicherheitsbefindlichkeit als 'sozialer Tatbestand'. Kriminalitätsfurcht und die Wahrnehmung von Sicherheit und Unsicherheit in Europa[END_REF] or [START_REF] Pavone | Key factors affecting public acceptance and acceptability of SOSTs[END_REF].

Due to the complexity of the model it will be presented in four parts or submodels to single out important influence factors. Three of the sub-models focus on the main constructs (security perceptions, privacy perceptions and trust in institutions) while the last one discusses the "acceptance of security practices" as the target variable. The data used for the model can be found in table 1 on pages 17 to 19.

The nodes in the following diagrams are representing those (influencing) variables that have a significant influence on the other (target) variable ("acceptance of a concrete security practice"). Elliptic nodes represent general demographics variables such as age, gender or education. Rectangular boxes stand for variables that are closely related to the context of surveillance and security practices. These include knowledge about data protection rights, experiences with privacy invasions etc. Hexagonal nodes stand for the main constructs that are also important mediating variables. The trapezoidal nodes finally stand for the target variable(s). 7 The coefficients listed in the second column of table 1 can also be found next to the edges.

Factors influencing "security concerns"

Figure 3 shows the influences that constitute citizens' personal security perception (in the context of surveillance oriented security practices). In contrast to the other constructs the security perception is strongly influenced by a number of factors. 6 For estimating fit and coefficients we have used the asymptotic distribution free (ADF) function for SEM. The main advantage of ADF is that it does not require multivariate normality. The estimation of the parameter is done minimizing the discrepancy between the empirical covariance matrix, S, and a covariance matrix implied by the model [START_REF] Michael | Asymptotically distribution-free methods for the analysis of covariance structures[END_REF]. 7 For reasons of simplicity and readability we are not using the normal notation in the following SEM path diagrams. Error terms are not displayed either.

Experience with prior privacy infringements has a strong positive effect on the security perception -this is in line with the notion that privacy and security are not perceived as competing values, but that privacy is rather seen as an element of security. On the other hand there are three factors that have a negative influence on the security perception. The higher the education the less worried citizens are about their security. The other negative influence factors are related to trust. The more people trust their fellow citizens and in particular institution the less their security concerns. Apart from these strong influence factors, age, gender and rural-urban classification have a weaker influence on the formation of security perceptions.

Security perceptions in turn have a strong influence on privacy perception (in concrete security contexts!) and finally on the target variables.

Factors influencing "privacy concerns"

The influence factors on privacy perceptions as the second important construct is shown in fig. 4. Privacy perception is constituted from a large number of influence factors without very dominant ones. The rather strong influence of the personal security perception was already mentioned before. Experience with privacy infringements and with privacy protecting measures (privacy activism) have a similarly strong influence on privacy perceptions. Minor influence factors include trust, political orientation and privacy knowledge. The educational level is having a relatively strong indirect influence moderated by trust and intensity of Internet use. In summary the formation of privacy perceptions depends on experience in the context where surveillance takes place and on general knowledge. These two elements help citizens to comprehend the complexity and rationale of surveillance measure and to assess the possibilities of safeguards. Privacy perceptions are the most important influence factor for citizens' acceptance or rejection of concrete surveillance oriented security measures either directly or indirectly via the assessment of the intrusiveness.

Factors influencing "trust in institutions"

As already mentioned before trust in institutions is another important moderating factor in citizens' assessment of security technologies and practices. Figure 5 shows how the trust construct is influenced by other factors. The most dominant influence is the other dimension of trust, the trust in persons which shows to be highly correlated with trust in institutions. Other more important factors include a person's political orientation, where more conservative (right-winged) persons have a higher trust in institutions such as state agencies, companies and the press. On the other hand trust -in concrete surveillance/security situationsis also influenced by experiences that citizens have had. People who found their privacy invaded are less trusting towards institutions in general. The direct influence of education, gender and rural-urban classification is less important on the formation of trust in institutions. Blinkert has pointed out that this is related to the "relative structural effectiveness", which he defines as a combination of the effectiveness of the state's monopoly on legitimate use of force and the extent of social welfare and distributive justice, that varies greatly between countries and regions [START_REF] Blinkert | Unsicherheitsbefindlichkeit als 'sozialer Tatbestand'. Kriminalitätsfurcht und die Wahrnehmung von Sicherheit und Unsicherheit in Europa[END_REF].

Trust in institutions has no immediate influence on the acceptance of a specific security measure but plays a strong role for people's assessment if such a measure is intrusive, i.e. if it threatens or protects people's fundamental rights. It also has minor effects on the perception of personal security and the perception of privacy, which in turn have a strong effect on acceptance.

Factors influencing acceptance of surveillance-oriented security technologies

Figure 6 finally shows which variables and constructs influence European citizens' acceptance or rejection of security practices. The most striking result is that the perceived impact of the practice on citizens' rights (here called intrusiveness) is the most critical factor for their acceptance or rejection that itself is strongly influenced by trust in institutions. Privacy and security perceptions follow as the next important factors, however, with a much smaller coefficient. Apart from these three factors most of the other variables play a direct or indirect role, but with a rather small contribution. The only new demographic variable that has a significant (but still small) influence on acceptance is the general attitude towards science and technology where people with a more positive assessment of their benefit have a greater acceptance.

The full picture

The combination of these sub-models does not only show the impacts described before but also the indirect and cumulative effects. Figure 7 is giving a comprehensive picture of the different factors influencing people's perceptions of privacy and security in the context of concrete applications of surveillance based security technologies. In this picture each of the variables (boxes) also includes the share that it contributes to the manifestation of the target variable. The higher this contribution, the bigger the size of the respective node. Apart from the importance of the perceived intrusiveness, trust in institutions and the general perception of privacy and personal security that have already been discussed play a significant role in the acceptance of security oriented surveillance practices. The picture also gives a better impression of the relevance of different personal characteristics.

Among the individual characteristics education plays the most important role: the higher the education level the lower the acceptance of security technology. The influence of education is moderated mainly over three channels: 1) More educated people have a higher level of trust with an influence on the perception of intrusiveness; 2) more educated people usually use the Internet more intensively and have thus more experiences with the possibilities of online surveillance and 3) more educated people have less worries about their personal security. The other influential personal characteristic is political orientation: More conservative people have a higher level of trust in institutions, also those operating surveillance oriented security technology and thus tend to accept them to a higher degree than more left-winged persons.

Noteworthy is also that age is playing a significant role in the model; the influence, however, on acceptance of surveillance based security technologies is small.

Discussion of results

Our analysis of the questions that aimed to measure European citizens' attitudes towards specific examples of surveillance technologies and practices has the following main results:

Trust in the operating institution is the essential factor for the acceptability of a security practice. The important role of trust, in people, in institutions as well as in the whole societal environment, is regularly confirmed in surveys [START_REF] Fox | Trust and privacy online: Why Americans want to rewrite the rules[END_REF][START_REF] Blinkert | Unsicherheitsbefindlichkeit als 'sozialer Tatbestand'. Kriminalitätsfurcht und die Wahrnehmung von Sicherheit und Unsicherheit in Europa[END_REF][START_REF] Hummelsheim | Subjektive Unsicherheit und Lebenszufriedenheit in Deutschland: Empirische Ergebnisse einer repräsentativen Bevölkerungsbefragung[END_REF].

The SurPRISE project, for instance, confirmed clearly that "the more people trust scientific and political institutions . . . the more acceptable a technology would be." In their explanatory model institutional trust is the strongest positive influence factor for acceptability of surveillance oriented security technologies [24, p. 135f.].

The PACT project on the other side stresses the strong impact that distrust has on the likelihood that citizens reject a given security measure [21, p. v].

Finally also a recent Eurobarometer study on Europeans' attitudes towards security found that institutions' respect for fundamental rights and freedoms is a strongly impacting the perception of security [26, p. 15f.] Transparency or openness has a positive effect on the willingness of citizens to accept security practices. This can be understood on different levels:

-Citizens tend to accept security practices when they are convinced that a security measure is necessary, proportionate and effective. -People are more easily convinced when a security practice is embedded in a context that citizens are familiar with and where they understand who is surveying whom and how. -As a result the surveillance activity should not be covert but perceivable for the citizen and communicated in a responsible way by the operator. -Understanding and acceptance is also a question of proper knowledge and education -though not only in one way. While education contributes to understanding technicalities and complexities of a security practices it also drives critical reflections. The SurPRISE project also confirmed most of these observations [24, p. 154f.].

-Current security practices, however, often do not seem to take this lesson seriously. In a Eurobarometer survey a majority of European citizens said they think that the security technologies and practices in the fight against terrorism and crime have restricted their rights and freedoms, which then is negatively impacting citizens' trust [26, p. 45ff.].

All these factors also involve an inherent risk for manipulation, since a security practice can be designed to create false trust among citizens to be accepted [START_REF] Barnard-Wills | Possible dual use of the decision support system[END_REF].

On the downside our empirical results also showed that many citizens do not care about surveillance that does not negatively affect them personally but only others. The SuPRISE project similarly concludes that "the more participants perceive SOSTs to be targeted at others rather than themselves, the more likely they are to find a SOST more acceptable" [24, p. 138].

Conclusions

For the design and introduction of security measures it is useful to consider some of the main socio-demographic determinants for acceptance of these measures, since poorly-designed measures can consume significant resources without achieving either security or privacy while others can increase security at the expense of privacy. However, since there is no natural trade-off between privacy and security, carefully designed solutions can benefit both privacy and security.

Law enforcement and government officials often heavily weight security. On the other hand we have shown in our analysis of the vignettes that citizens' opinions on security measures vary, and are influenced by some crucial factors. Apart from trust in the operating agency or company we could observe mainly four different types of reactions [START_REF] Conti | Deconstructing the Relationship between Privacy and Security[END_REF]:

1. Citizens may consider a measure as useless to enhance security, and at the same time invasive for their privacy. Such a situation has to be absolutely avoided. 2. Citizens may consider a measure useless to enhance security but with no risk for their privacy. 3. Citizens may consider a measure as useful in terms of security, but privacy invasive. 4. Finally, citizens may consider a measure both useful to increase security and with no risk for their privacy.

However, citizen perceptions do not (always) have to reflect the real effectiveness of a security measure and its real impact on privacy. Considering the importance of trust for the acceptability and acceptance the responsible parties should aim to reconcile the perceived and real impacts. Potential for conflicts can be mainly found at the border between reaction types 2 and 3 when citizens fear an invasion of their privacy or perceive a technology as ineffective. Citizens' reactions are mostly based upon perceptions rather than rational factbased assessments. As we have shown before these are influenced by a multitude of factors. Trust in institutions is one, the perceived self-interest is another, the measure being overt or covert a potential third. These three elements should be taken into account in the design of new security technologies and in specific security investments. For these cases PRISMS has developed a participatory and discursive technique that can help decision-makers in industry, public authorities and politics to implement security measures that raise fewer concerns in the population and are thus more acceptable along the lines stated in many policy documents [START_REF] Marc Van Lieshout | The PRISMS Decision Support System[END_REF][START_REF] Barnard-Wills | Security, Privacy and Surveillance in European policy documents[END_REF].

Fig. 3 .

 3 Fig. 3. Sub-model for security concerns. Dotted lines = negative influence, solid lines = positive influence, thickness of the line = strength of the influence

Fig. 4 .

 4 Fig. 4. Sub-model for privacy concerns. Dotted lines = negative influence, solid lines = positive influence, thickness of the line = strength of the influence

Fig. 5 .

 5 Fig. 5. Sub-model for citizens' trust in institutions. Dotted lines = negative influence, solid lines = positive influence, thickness of the line = strength of the influence

Fig. 6 .

 6 Fig. 6. Sub-model for acceptance of surveillance-oriented security technologies. Dotted lines = negative influence, solid lines = positive influence, thickness of the line = strength of the influence

Fig. 7 .

 7 Fig. 7. Model of factors influencing acceptance of SOSTs (simplified). Dotted lines = negative influence, solid lines = positive influence, thickness of the line = strength of the influence, size of nodes = overall influence of factor on acceptance

E.g. in the context of environmentalism consumers often state a high importance of environmental protection that is not reflected in their actual behaviour[START_REF] Kollmuss | Mind the Gap: why do people act environmentally and what are the barriers to pro-environmental behavior?[END_REF].

The vignettes depicted situations of 1) foreign government (NSA type) surveillance, 2) school access by biometrics, 3) usage of smart meter data, 4) monitoring of terrorist website visits

, 5) speed control in neighbourhoods by automatic number plate recognition (ANPR), 6) selling of Internet Service Provider (ISP) data, 7) use of DNA databases by police and 8) smart video surveillance of crowds.

The full questionnaire, technical details of the fieldwork and detailed analyses of the survey can be found in[START_REF] Friedewald | Report on the analysis of the PRISMS survey[END_REF].

Acknowledgement

This work was carried out in the project "PRISMS: Privacy and Security Mirrors" co-funded from the European Union's Seventh Framework Programme for research, technological development and demonstration under grant agreement 285399. For more information see: http://prismsproject.eu.