CoChat
Sign Up
Cited by 72Blockchain Technology Applications and SecurityDigitalization, Law, and RegulationPrivacy, Security, and Data Protection

GDPR Compliance Verification in Internet of Things

Open access
Barati, Masoud, Rana, Omer, Petri, Ioan, Theodorakopoulos, George·2020·IEEE Access
DOI 10.1109/access.2020.3005509
Open this paper in CoChat — free accountOpen PDF

Abstract

Data privacy in Internet of Things (IoT) applications remains a major concern of regulation bodies.The introduction of the European General Data Protection Regulation (GDPR) enables users to control how their data is accessed and processed, requiring consent from users before any data manipulation is carried out on their (personal) data by smart devices or cloud-hosted services.Blockchains provide the benefits of a distributed and immutable ledger recording digital transactions across a global network of peer nodes.Blockchain support for tracking of operations carried out by an IoT-based system provides greater confidence to a user that the IoT device is not infringing user privacy (as the Blockchain can be audited to verify which operation was carried out, by which actor).A formal model (following the privacy-bydesign approach) is proposed for supporting GDPR compliance checking for smart devices.The privacy requirements of such applications are related to GDPR obligations of device (and software systems) operators (such as user consent, data protection, right to forget etc).Three smart contracts are proposed as a practical solution to support automated verification of operations carried out by devices on user data, in accordance with GDPR rules.We evaluate the performance and scalability costs of our approach using a Blockchain test network.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/access.2020.3005509

Cites

4 of 4 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Wu et al. reviewed security and privacy issues in the use, storage, and processing of IoT data using edge intelligence.

    “Wu et al. [107] reviewed the security and privacy issues in the use, storage, and processing of IoT data using edge intelligence.”

    From A Survey of IoT Privacy Security: Architecture, Technology, Challenges, and Trends (2024) · cites this paper as [107]

    The Introduction discusses privacy and security concerns in IoT data use and storage, and the blockchain-based model section mentions edge computing gateways. Neither passage describes a Wu et al. review of security and privacy issues involving edge intelligence. Searches for that review and for edge intelligence found no supporting passage in our copy. (LLM, conf=0.72)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 37

  1. M. Barati, I. Petri, and O. F. Rana, "Developing GDPR compliant user data policies for Internet of things," in Proc. of the 12th IEEE/ACM International Conference on Utility and Cloud Computing, Auckland, New Zealand, 2019, pp. 133-141.
  2. M. Barati and O. Rana, "Enhancing user privacy in IoT: integration of GDPR and blockchain," Blockchain and Trustworthy Systems. BlockSys 2019. Communications in Computer and Information Science, Z. Zheng, HN. Dai, M. Tang, and X. Chen (Eds), Springer, Singapore, vol. 1156, pp. 322-335, 2020. VOLUME 4, 2016
  3. T. Salman, M. Zolanvar, A. Erbad, R. Jain, and M. Samaka, "Security ser- vices using blockchains: A state of the art survey," IEEE Communications Surveys and Tutorials, vol. 21, no. 1, pp. 858-880, 2018.
  4. M. Virvou and E. Mougiakou, "Based on GDPR privacy in UML: case of e-learning program," in Proc. of 8th International Conference on Informa- tion, Intelligence, Systems and Applications, Larnaca, Cyprus, 2017.
  5. B. Russo, L. Valle, G. Bonzagni, D. Locatello, M. Pancaldi, and D. Tosi, "Cloud computing and the new EU general data protection regulation," IEEE Cloud Computing, vol. 5, no. 6, pp. 58-68, 2018.
  6. M. Barati, O. Rana, G. Theodorakopoulos, and P. Burnap, "Privacy-aware cloud ecosystems and GDPR compliance," in Proc. of the 7th International Conference on Future Internet of Things and Cloud, Istanbul, Turkey, 2019, pp. 117-124.
  7. H. A. Abdulghani, N. A. Nijdam, A. Collen, and D. Konstantas, "A study on security and privacy guidelines, countermeasures, threats: IoT data at rest perspective," Symmetry, vol. 11, no. 6, 2019.
  8. S. Imtiaz, R. Sadre, and V. Vlassov, "On the case of privacy in the IoT ecosystem: A survey," in Proc. of the International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), Atlanta, GA, 2019, pp. 1015-1024.
  9. L. Urquhart, T. Lodge, and A. Crabtree, "Demonstrably doing accountabil- ity in the Internet of things," International Journal of Law and Information Technology, vol. 27, no. 1, pp. 1-27, 2019.
  10. Z. Zheng, S. Xie, H. Dai, X. Chen, and H. Wang, "An overview of blockchain technology: architecture, consensus, and future trends," in Proc. of the 6th International Congress on Big Data, Honolulu, USA, 2017, pp. 557-564.
  11. Q. Zhu, S. W. Loke, R. Trujillo-Rasua, F. Jiang, and Y. Xiang, "Applica- tions of distributed ledger technologies to the Internet of things: A survey," ACM Computing Surveys, vol. 52, no. 6, 2019.
  12. H-N. Dai, Z. Zheng, and Y. Zhang, "Blockchain for Internet of Things: A survey," IEEE Internet of Things Journal, vol. 6, no. 5, pp. 8076-8094, 2019.
  13. X. Wang, X. Zha, W. Ni, R. P. Liu, Y. J. Guo, X. Niu, and K. Zheng, "Survey on blockchain for Internet of things," Computer Communications, vol. 136, pp. 10-29, 2019.
  14. K. Gai, Y. Wu, L. Zhu, Z. Zhang, and M. Qiu, "Differential privacy- based blockchain for industrial internet of things," IEEE Transactions on Industrial Informatics, 2019. DOI: 10.1109/TII.2019.2948094. · DOI
  15. A. Boudguiga, N. Bouzerna, L. Granboulan, and A. Olivereau, "Towards better availability and accountability for IoT updates by means of a blockchain," in Proc. of the European Symposium on Security and Privacy Workshops, Paris, France, 2017, pp. 50-58.
  16. R. Paul, P. Baidya, S. Sau, K. Maity, S. Maity, and S. B. Mandal, "IoT based secure smart city architecture using blockchain," in Proc. of the 2nd International Conference on Data Science and Business Analytics, Changsha, China, 2018, pp. 215-220.
  17. D-P. Le, H. Meng, L. Su, S. L. Yeo, and V. Thing, "BIFF: A blockchain- based IoT forensics framework with identity privacy," in Proc. of the TENCON, IEEE Region 10 International Conference, Jeju, South Korea, 2018, pp. 2372-2377.
  18. B. Tang, H. Kang, J. Fan, Q. Li, and R. S. Sandhu, "IoT passport: a blockchain-based trust framework for collaborative Internet-of things," in Proc. of the 24th ACM Symposium on Access Control Models and Technologies, Toronto, Canada, 2019, pp. 83-92.
  19. A. D. Dwivedi, G. Srivastava, S. Dhar, and R. Singh, "A decentralized privacy-preserving healthcare blockchain for IoT," Sensors, vol. 19, no. 2, 2019.
  20. P. Lv, L. Wang, H. Zhu, W. Deng, and L. Gu, "An IoT oriented privacy- preserving publish/subscribe model over blockchains," IEEE Access, vol. 7, pp. 41309-41314, 2019.
  21. K. Rantos, G. Drosatos, K. Demertzis, C. Ilioudis, and A. Papanikolaou, "Blockchain-based consents management for personal data processing in the IoT ecosystem," in Proc. of the 15th International Joint Conference on e-Business and Telecommunications, Porto, Portugal, 2018, pp. 572-577.
  22. A. Crabtree, T. Lodge, J. Colley, C. Greenhalgh, K. Glover, H. Haddadi, Y. Amar, R. Mortier, Q. Li, J. Moore, L. Wang, P. Yadav, J. Zhao, A. Brown, L. Urquhart, and D. McAuley, "Building accountability into the Internet of Things: the IoT Databox model," Journal of Reliable Intelligent Environments, vol. 4, no. 1, pp. 39-55, 2018.
  23. M. Rhahla, T. Abdellatif, R. Attia, and W. Berrayana, "A GDPR controller for IoT systems: application to e-health," in Proc. of the 28th International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises, Napoli, Italy, 2019, pp. 170-173.
  24. G. Y. Lee, K. J. Cha, and H. J. Kim, "Designing the GDPR compliant consent procedure for personal information collection in the IoT environ- ment," in Proc. of the International Congress on Internet of Things, Milan, Italy, 2019, pp. 79-81.
  25. M. Koutli, N. Theologou, A. Tryferidis, D. Tzovaras, A. Kagkini, D. Zandes, K. Karkaletsis, K. Kaggelides, J. A. Miralles, V. Oravec, and S. Vanya, "IoT e-Health applications using VICINITY framework and GDPR guidelines," in Proc. of the 15th Int. Conf. on Distributed Comp. in Sensor Systems, Santorini Island, Greece, 2019, pp. 263-270.
  26. E. Anthi, S. Ahmad, O. Rana, P. Burnap, G. Theodorakopoulos, "Eclip- seIoT: A secure and adaptive hub for the Internet of Things". Computers and Security 78, pp. 477-490, 2018. Elsevier.
  27. H. Ghayvat, S. Mukhopadhyay, X. Gui, and N. Suryadevara, "WSN-and IOT-based smart homes and their extension to smart buildings," Sensors, vol. 15, no. 5, pp. 10350-10379, 2015.
  28. Y. Dong, Y. Wen, H. Hu, C. Miao, and C. Leung, "Design tradeoffs for cloud-based ambient assisted living systems," in Proc. of the 2nd International Conference on Crowd Science and Engineering, Beijing, China, 2017.
  29. D. Basin, S. Debois, and T. Hildebrandt, "On purpose and by necessity: Compliance under the GDPR," in Proc. of the International Conference on Financial Cryptography and Data Security, Nieuwpoort, Curacao, 2018, pp. 20-37.
  30. Z. Zheng, S. Xie, H-N. Dai, W. Chen, X. Chen, J. Weng, and M. Imran, "An overview on smart contracts: Challenges, advances and platforms," Future Generation Computer Systems, vol. 105, pp. 475-491, 2020.
  31. H. Qiu, M. Qiu, G. Memmi, Z. Ming, and M. Liu, "A dynamic scal- able blockchain based communication architecture for IoT," in Proc. of the International Conference on Smart Blockchain, Tokyo, Japan, 2018, pp. 159-166.
  32. R. Morabito, "Virtualization on Internet of things edge devices with container technologies: A performance evaluation," IEEE Access, vol. 5, pp. 8835-8850, 2017.
  33. K. Dolui and C. Király, "Towards multi-container deployment on IoT gateways," IEEE Global Communications Conference (GLOBECOM), Abu Dhabi, United Arab Emirates, 2018, pp. 1-7.
  34. T. Al Said, O. F. Rana, and P. Burnap, "VMInformant: An instrumented virtual machine to support trustworthy cloud computing," International Journal of High Performance Computing & Networking, vol. 8, no. 3, pp. 222-234, 2015.
  35. N. El Ioini and C. Pahl, "Trustworthy orchestration of container based edge computing using permissioned Blockchain," in Proc. of the 5th International Conference on Internet of Things: Systems, Management and Security, Valencia, Spain, 2018.
  36. E. Casalicchio and S. Iannucci, "The state-of-the-art in container technolo- gies: Application, orchestration and security," Concurrency and Computa- tion: Practice and Experience, e5668, 2020. DOI: 10.1002/cpe.5668. · DOI
  37. G. Wood, "Polkadot: Vision for a heterogeneous multi-chain framework," Whitepaper, 2017. DOI: 10.1021/acs.jpcc.6b00269. · DOI

Cited by

Sorted by citations

Authors
Barati, M., Rana, O., Petri, I., & Theodorakopoulos, G.
Affiliations
Cardiff University (GB)
ORCID
Venue
IEEE Access
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2020
Volume
8
Pages
119697-119709
ISSN
2169-3536 (ISSN-L)
DOI
10.1109/access.2020.3005509
OpenAlex
W3038333533
Cited by
72
References
4
Citations by year
2026: 12 · 2025: 15 · 2024: 13 · 2023: 15 · 2022: 7 · 2021: 9 · 2012: 1
FWCI
7.30
Type
journal article
Language
en
Open access
Licence
Locations
  • IEEE Access (publishedVersion, cc-by)
  • Research Output (Edinburgh Napier University) (publishedVersion, other-oa)
  • ORCA Online Research @Cardiff (Cardiff University) (submittedVersion, cc-by)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
  • Edinburgh Napier Research Repository (Edinburgh Napier University) (submittedVersion, cc-by)
  • Newcastle University ePrints (Newcastle Univesity)
Funders
  • EPSRC (EP/R033439/1)
  • Project title: “PACE: Privacy-aware Cloud Ecosystems.”
  • extend appreciation to the Deanship of Scientific Research at Princess Nourah bint Abdualrahman University for supporting his work through the visiting scholar program
Topics
  • Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
Keywords
GDPR compliance, Internet of Things, blockchain, smart contracts, data privacy, privacy by design, user consent, right to be forgotten, data protection, smart devices, compliance verification

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review