Prevention of personally identifiable information leakage in ecommerce using offline data minimization and online pseudonymisation.

The rapid adoption of electronic channels for the delivery of services by various service providers compels the consumers of these services to adapt. For one to be granted access to e-services, one must surrender part of their Personally Identifiable Information (PII) hence making their personal data susceptible to leakage. Despite several solutions being already in use to protect PII, data leakage persists. To enhance PII protection and user privacy, the research proposes employing Offline Data minimization and Pseudonymisation using physical and logical partitions implemented through a combination of hardware and software. The implementation includes the use of unique random pseudo-ID algorithm derived from the modification of the Request for Comment (RFC) time-based One Time Password (TOTP) standard RFC 6238. The random pseudo-ID can be used to transact online while preventing online profiling that is possible when using static pseudo-IDs. The Random ID generator algorithm can be used to trace the user of a given Random pseudo–ID. Data is most vulnerable to leakage when it is accessible via the Internet. The solution developed addressed the problem of PII data leakage by making sensitive data ‘offline’ to the internet. The methodology employed the Trusted Third Party (TTP) approach. This meant having a third party collecting PII from e-commerce users and confirming the KYC of users who would like to be granted access to e-commerce platforms hence preventing the spreading of aggregated PII across the cyber space. At the TTP, this was achieved by data Minimization of sensitive personal information and pseudonymization of information to be made available for online transactions. To keep the PII ‘Offline’, a multi-layered hardware approach was used; two microcontrollers were configured to create a buffer that ensured one-way traffic towards the online-sub system that held minimized pseudonymized data. To further restrict the amount of data that could flow from the offline system to the online system, the bandwidth between the microcontrollers was restricted to 9,600bps. Experiment results showed that the ‘offline’ system hosting the PII could not be accessed. Further, Random IDs were successfully generated to ensure privacy is maintained for users. Key words Personally Identifiable Information, Data Privacy, One Time Password, Data Protection, Time-based One Time Password, Firmware, and TOR

Grantor dc:publisher

The University of Zambia

Year dc:date.issued

2023

Author dc:creator

• Kangwa, Mukuka

• Offline data minimization.
• Online pseudonymisation.

Language dc:language.iso

en

Repository record dc:identifier.uri

http://dspace.unza.zm/handle/123456789/8044

OAI identifier oai:identifier

oai:dspace.unza.zm:123456789/8044