A Hardware-Anchored Privacy Middleware for PII Sharing Across Heterogeneous Embedded Consumer Devices

This paper introduces the User Data Sharing System (UDSS), a hardware-anchored, platform-agnostic middleware for heterogeneous consumer electronics that enhances privacy and reduces onboarding friction by enforcing context-aware PII sharing and data minimization without relying on persistent cloud-based user-device binding.

The Gist

Imagine you just bought a brand-new Smart TV. You want to watch your favorite shows, but first, you have to log in.

The Problem: The "Remote Control Nightmare"
Right now, logging into apps on your TV is a pain. You have to use a tiny remote control to type in your email and password letter by letter. It's slow, frustrating, and often makes people give up.

Even worse, when you do manage to log in, the app often asks for way more information than it needs. It's like walking into a coffee shop to buy a latte, and the barista asks for your home address, your mother's maiden name, and your shoe size just to give you a cup of coffee. They don't need that data, but they ask for it anyway because the current system doesn't stop them.

The Solution: UDSS (The "Smart Bouncer")
This paper introduces a new system called UDSS (User Data Sharing System). Think of UDSS as a super-smart, unbreakable bouncer that lives inside your TV's hardware.

Here is how it works, using simple analogies:

1. The "Hardware Vault" (The Trust Zone)

Most apps run in the "living room" of your TV's brain, where they can see everything. UDSS lives in a secret, reinforced vault inside the TV's processor (called ARM TrustZone).

• Analogy: Imagine your TV has a glass living room where apps hang out, but your personal data (like your email) is locked in a steel safe in the basement. Only the UDSS bouncer has the key to the safe. Even if a hacker breaks into the living room, they can't touch the safe.

2. The "Contextual Bouncer" (CSE)

This is the coolest part. The bouncer knows the difference between "Just saying hello" (Sign-In) and "Joining the club" (Sign-Up).

• Sign-In (Just saying hello): If you just want to log in to Netflix, the bouncer says, "Okay, I'll give the app only your email address." It blocks everything else. It's like handing the bouncer a single business card instead of your entire life story.
• Sign-Up (Joining the club): If you are creating a new account, the bouncer might allow a few more details (like your name), but it still checks a strict list to make sure the app isn't asking for things it doesn't need.
• The Result: The app gets exactly what it needs, nothing more. No more "over-asking."

3. The "Tamper-Proof Receipt Book" (Audit Ledger)

Every time an app asks for your data, the bouncer writes it down in a special, unchangeable notebook that lives in the secure vault.

• Analogy: It's like a bank teller who writes down every transaction in a book that can't be erased or altered. If you ever want to know, "Who saw my data?" you can check the book. If you want to say, "Stop sharing my data," you can tear out the page (revoke consent), and the bouncer will immediately stop that app from seeing anything.

4. The "Anti-Fake Screen" (Trusted Display)

Sometimes, a bad app tries to trick you. It might show a fake "Allow" button that looks like the real system, hoping you click it by mistake.

• Analogy: UDSS uses a special "secure channel" to draw the consent screen. It's like the bouncer stepping in front of the TV screen with a shield. The bad app cannot draw anything over the shield. You only see the real question from the system, not a fake one created by a hacker.

Why Does This Matter?

The researchers tested this on a Raspberry Pi (a small computer that acts like a TV). Here is what they found:

• Speed: Logging in became 65% faster. No more typing with a remote!
• Privacy: Apps that used to steal 5 pieces of your data were forced to take only 1.
• Safety: It works without needing to constantly call a big cloud server, making it faster and more private.

The Bottom Line

UDSS is like giving your Smart TV a privacy guardian that lives in a secure vault. It stops apps from being greedy with your data, stops you from having to type with a remote, and keeps a perfect record of who saw what. It makes the "lean-back" experience of watching TV safe and easy again, without the "lean-forward" headache of managing your digital identity.

Technical Summary

1. Problem Statement

The rapid expansion of the Internet of Things (IoT) and smart home ecosystems has created a fragmented landscape for user data management across Consumer Electronics (CE) such as Smart TVs, gaming consoles, and set-top boxes. The paper identifies three critical issues:

• High-Friction Onboarding: Current account registration on CE devices requires manual data entry via infrared (IR) remotes, leading to significant user drop-off.
• Lack of Cross-Platform Standards: Unlike mobile ecosystems with centralized identity providers, the CE industry lacks a unified standard for sharing Personally Identifiable Information (PII) across diverse operating systems (Tizen, WebOS, Linux).
• Over-Permissioning and Privacy Risks: Existing protocols (e.g., OAuth 2.0, FIDO2) often operate on a "binary" consent model. They lack granular, field-level minimization, allowing applications to request excessive PII (e.g., demographics for simple authentication). Furthermore, cloud-anchored solutions like FIDO2/WebAuthn are ill-suited for shared-screen environments where persistent user-to-device binding is impractical.

2. Methodology: The User Data Sharing System (UDSS)

The authors propose UDSS, a platform-agnostic middleware framework designed to facilitate secure, privacy-first PII exchange. The system is built on a device-anchored trust model rather than relying on cloud identity providers.

Core Architecture Components:

• Privacy Gateway (Trusted Application):
  • Implemented within the ARM TrustZone secure world and managed by OP-TEE (Open Portable Trusted Execution Environment).
  • Acts as the sole runtime arbiter for user PII, ensuring cryptographic operations and consent logic are isolated from the Rich Execution Environment (REE), even if the OS is compromised.
  • Intercepts system IPC calls (e.g., D-Bus, Binder) to monitor identity sharing requests.
• Platform Identity Manager (PIM):
  • Serves as the authoritative, encrypted repository for user PII (using schemas like encrypted SQLite or secure elements).
  • Organizes data into "drawers" (Identity, Contact, Address, Demographics) that are unlocked only via cryptographic tokens issued by the Gateway after explicit consent.
  • Maintains a hash-chained, append-only Audit Ledger within TEE memory to track all access attempts, supporting GDPR Article 15 (Right of Access).
• Contextual Scope Enforcement (CSE):
  • A protocol-level mechanism that dynamically restricts data exposure based on user intent.
  • Sign-In Context: Strictly limits the response to a single unique identifier ($N_{fields} = 1$, e.g., email or phone).
  • Sign-Up Context: Allows multiple fields but restricts them to the intersection of requested scopes and the application's pre-approved tier policy.
• Consent User Interface (CUI):
  • A system-level overlay rendered exclusively within the OP-TEE trusted display path.
  • Prevents third-party applications from accessing the display buffer during the consent loop, mitigating "UI Redressing" and "Clickjacking" attacks.

Security Protocols:

• Tiered Access Model: Applications are assigned tiers (Standard vs. Premium) based on a locally cached, TEE-verified Partnership Manifest.
• Cryptographic Security:
  • RS256 signatures for token integrity (keys generated and stored in TrustZone).
  • AES-256-GCM for payload encryption (ephemeral session keys generated per transaction).
  • Nonce and Timestamps: Prevents replay attacks.

3. Key Contributions

1. Platform-Agnostic Framework: A solution specifically designed for shared-screen CE environments where FIDO2/WebAuthn assumptions (per-user authenticator enrollment) fail.
2. Contextual Scope Enforcement (CSE): A novel mechanism that programmatically enforces data minimization ($N_{fields} = 1$ for Sign-In) before the user sees a consent prompt, shifting enforcement from developer best practices to the protocol level.
3. Hardware-Anchored Privacy Gateway: A TEE-based architecture that mediates developer access using hardware-verified manifests and a tamper-resistant audit ledger, eliminating the need for cloud round-trips during onboarding.
4. Regulatory Compliance by Design: The architecture structurally supports GDPR (Data Minimization, Right to Erasure) and CCPA (Right to Know, Opt-out of Sale) obligations.

4. Results and Evaluation

The system was implemented as a proof-of-concept on a Raspberry Pi 4 (ARMv8) running Yocto Linux with OP-TEE 3.20.

• Onboarding Latency:
  • UDSS reduced onboarding time to 6.3 seconds (mean), compared to 18.4 seconds for manual entry and 11.2 seconds for OAuth Device Flow.
  • This represents a 65.8% reduction compared to manual entry and a 43.8% reduction compared to OAuth.
• System Overhead:
  • CPU: The Gateway validation logic consumes < 2% of CPU cycles.
  • Latency: Encryption and signing add a negligible 42 ms penalty.
  • Memory: The PIM and Gateway maintain a steady-state footprint of 12 MB in secure world memory.
• Security Validation (PII Exposure):
  • In simulations where a malicious app requested 5 PII fields for a Sign-In:
    • OAuth Baseline: Exposed all 5 fields (0% enforcement).
    • UDSS: Exposed only 1 field (email), blocking the other 4 in 100% of trials.
  • This resulted in a 79% reduction in PII exposure for Sign-In workflows.

5. Significance

This paper addresses a critical gap in the smart home ecosystem: the lack of a secure, low-friction, and privacy-preserving identity management standard for shared consumer devices.

• Shift from Cloud to Device: By anchoring trust in the device's TEE (TrustZone) rather than a cloud provider, UDSS enables offline-capable, privacy-centric onboarding that respects the "lean-back" nature of TV usage.
• Architectural Data Minimization: It moves beyond voluntary developer compliance to enforce data minimization at the protocol and hardware levels, directly addressing regulatory requirements like GDPR and CCPA.
• Future-Proofing: The framework provides a foundation for integrating AI-driven security agents (which require high-fidelity but minimal data) and supports future extensions like W3C Decentralized Identifiers (DIDs) and biometric attestation.

In conclusion, UDSS demonstrates that it is possible to significantly improve user experience (reducing onboarding time by 65%) while simultaneously strengthening privacy guarantees through hardware-enforced data minimization.