Controlling how privacy enhancing technology is applied

Abstract

It is provided a method for controlling how privacy enhancing technology, PET, is applied to a data stream, the method being performed by an evaluation device (2, 3). The method comprises: evaluating at least one parameter of the data stream or data content of the data stream, wherein the at least one parameter is indicative of a property that has an effect on how PET is applied; determining a change in the at least one parameter; generating a privacy signal based on the change in the at least one parameter; establishing a signalling channel (16) to a server (6), wherein the signalling channel is distinct from a data stream channel (15) for transferring the data stream; and transmitting the privacy signal over the signalling channel to the server to affect how the PET is applied to the data stream.

Description

CONTROLLING HOW PRIVACY ENHANCING TECHNOLOGY IS APPLIEDTECHNICAL FIELD

[0001] The present disclosure relates to the field of privacy and in particular to controlling how privacy enhancing technology (PET) is applied to a data stream.BACKGROUND

[0002] There are many sources of content, including cameras, audio, environment sensors, etc. The growth of XR (extended reality) is expected to increase the amount of produced content even more.

[0003] However, content can contain sensitive data that some users do not want to share due to privacy concerns. As most of the applications rely heavily on data, employing the relevant information carried by these data while preserving confidentiality and privacy of the content producers is a complex process. Beside the solutions based on laws and regulations (e.g. GDPR (General Data Protection Regulation) in the European Union), technical solutions, called privacy enhancing technologies (PETs), can be employed and embedded in applications that process content data, to ensure confidentiality and privacy.

[0004] Ideally, PETs are applied very close to the data source (i.e. on the same device that captures or generates the data). But when this is not feasible due to, e.g. processing limitations of the device, PET is offloaded to a node (such as a server) topologically after the data collection, in the path of the data stream containing the content. Depending on its type and functionality, the processing of the offloaded PET adds computational cost, as well as latency overhead, in the data processing pipeline.

[0005] In applications where the presence or absence of a particular individual or data value is to be protected, a category of PETs which offer probabilistic guarantees on their level of privacy protection can be employed. These methods obfuscate the result of a query run on the original data with the help of added noise, e.g. differential privacy (DP). In order to guarantee the privacy protection, the system employing DP needs to limit the number of queries that can be made. This is done with the help of a privacy budget which is divided among the number of queries. For instance, a user can chooseto perform one query and use the whole budget or 100 queries, each using o.oi of the privacy budget.

[0006] In the case of DP, the noise originates from a known distribution (e.g. a Laplacian distribution) and the quantity of noise that is added depends on a parameter e, which also defines the privacy budget. Smaller values of e add more noise (better privacy, worse accuracy). When the privacy budget is depleted, the system refuses new queries, as this will violate the privacy guarantees. Violating the privacy budget (allowing for a larger number of queries) would allow an adversary to reconstruct the noise distribution and de-anonymize the data.

[0007] In the case of static datasets, choosing an optimal value for the privacy budget is a straightforward process, as the characteristics of data and the types of queries run are known and fixed. For data streams of unknown length, this is a more complex problem since characteristics of the data can change over time, e.g. changed frame rate for video, changed bitrate for audio or changed sensor sampling frequency for a sensor. When the data is provided in a data stream, it should be possible to change how PET is applied in real-time.

[0008] CN 114884682 B discloses a crowd sensing data stream privacy protection method based on adaptive local differential privacy. However, the solution in the cited document relies on the privacy protection being provided locally, i.e. PET is not offloaded to a server.SUMMARY

[0009] One object is to improve how PET is adapted over time when the PET processing is performed in a different node than the content source.

[0010] According to a first aspect, it is provided a method for controlling how privacy enhancing technology, PET, is applied to a data stream, the method being performed by an evaluation device. The method comprises: evaluating at least one parameter of the data stream or data content of the data stream, wherein the at least one parameter is indicative of a property that has an effect on how PET is applied; determining a change in the at least one parameter; generating a privacy signal based onthe change in the at least one parameter; establishing a signalling channel to a server, wherein the signalling channel is distinct from a data stream channel for transferring the data stream; and transmitting the privacy signal over the signalling channel to the server to affect how the PET is applied to the data stream.[oon] The evaluating at least one parameter may comprise evaluating a parameter based on data content of the data stream.

[0012] The parameter based on the data content of the data stream may be a frame rate of video data content, or a bit rate of audio data content.

[0013] The evaluating at least one parameter may comprise evaluating a parameter based on network characteristics of the data stream.

[0014] The parameter based on the network characteristics of the data stream may be at least one of a packet rate, data throughput, and jitter.

[0015] Traffic on the signalling channel may have higher priority than traffic on the data stream channel.

[0016] Traffic on the signalling channel, on average, may have lower latency than traffic on the data stream channel.

[0017] The signalling channel and the data stream channel may be provided using different network slices.

[0018] The signalling channel and the data stream channel may be provided using different networks.

[0019] The signalling channel may be provided using low latency low loss scalable throughput, L4S.

[0020] The signalling channel and the data stream channel may be distinguished from each other using user equipment route selection policy, URSP.

[0021] According to a second aspect, it is provided an evaluation device for controlling how privacy enhancing technology, PET, is applied to a data stream. Theevaluation device comprises: processing circuitry; and memory circuitry storing instructions that, when executed by the processing circuitry, cause the evaluation device to: evaluate at least one parameter of the data stream or data content of the data stream, wherein the at least one parameter is indicative of a property that has an effect on how PET is applied; determine a change in the at least one parameter; generate a privacy signal based on the change in the at least one parameter; establish a signalling channel to a server, wherein the signalling channel is distinct from a data stream channel for transferring the data stream; and transmit the privacy signal over the signalling channel to the server to affect how the PET is applied to the data stream.

[0022] The instructions to evaluate at least one parameter may comprise instructions that, when executed by the processing circuitry, cause the evaluation device to evaluate a parameter based on data content of the data stream.

[0023] The parameter based on the data content of the data stream may be a frame rate of video data content, or a bit rate of audio data content.

[0024] The instructions to evaluate at least one parameter may comprise instructions that, when executed by the processing circuitry, cause the evaluation device to evaluate a parameter based on network characteristics of the data stream.

[0025] The parameter based on the network characteristics of the data stream may be at least one of a packet rate, data throughput, and jitter.

[0026] Traffic on the signalling channel may have higher priority than traffic on the data stream channel.

[0027] Traffic on the signalling channel, on average, may have lower latency than traffic on the data stream channel.

[0028] The signalling channel and the data stream channel may be provided using different network slices.

[0029] According to a third aspect, it is provided a computer program for controlling how privacy enhancing technology, PET, is applied to a data stream. The computer program comprises computer program code which, when executed on an evaluationdevice causes the evaluation device to: evaluate at least one parameter of the data stream or data content of the data stream, wherein the at least one parameter is indicative of a property that has an effect on how PET is applied; determine a change in the at least one parameter; generate a privacy signal based on the change in the at least one parameter; establish a signalling channel to a server, wherein the signalling channel is distinct from a data stream channel for transferring the data stream; and transmit the privacy signal over the signalling channel to the server to affect how the PET is applied to the data stream.

[0030] According to a fourth aspect, it is provided a computer program product comprising a computer program according to the third aspect and a computer readable means comprising non-transitory memory in which the computer program is stored.

[0031] According to a fifth aspect, it is provided a method for controlling how privacy enhancing technology, PET, is applied to a data stream, the method being performed by a server. The method comprises: establishing a signalling channel to an evaluation device, wherein the signalling channel is distinct from a data stream channel for transferring the data stream; receiving a privacy signal over the signalling channel from the evaluation device; adjusting how the PET is applied to the data stream based on the privacy signal.

[0032] The adjusting may comprise adjusting a privacy budget for the PET based on the privacy signal.

[0033] The PET may be based on adding a noise component to the data content of the data stream.

[0034] The PET may be based on differential privacy.

[0035] The PET may be based on k-anonymity.

[0036] The PET may be based on 1-diversity.

[0037] According to a sixth aspect, it is provided a server for controlling how privacy enhancing technology, PET, is applied to a data stream. The method comprises: processing circuitry; and memory circuitry storing instructions that, when executed bythe processing circuitry, cause the server to: establish a signalling channel to an evaluation device, wherein the signalling channel is distinct from a data stream channel for transferring the data stream; receive a privacy signal over the signalling channel from the evaluation device; and adjust how the PET is applied to the data stream based on the privacy signal.

[0038] The instructions to adjust may comprise instructions that, when executed by the processing circuitry, cause the server to adjust a privacy budget for the PET based on the privacy signal.

[0039] The PET may be based on adding a noise component to the data content of the data stream.

[0040] According to a seventh aspect, it is provided a computer program for controlling how privacy enhancing technology, PET, is applied to a data stream. The computer program comprises computer program code which, when executed on a server causes the server to: establish a signalling channel to an evaluation device, wherein the signalling channel is distinct from a data stream channel for transferring the data stream; receive a privacy signal over the signalling channel from the evaluation device; and adjust how the PET is applied to the data stream based on the privacy signal.

[0041] According to an eighth aspect, it is provided a computer program product comprising a computer program according to the seventh aspect and a computer readable means comprising non-transitory memory in which the computer program is stored.

[0042] According to a ninth aspect, it is provided a system for controlling how privacy enhancing technology, PET, is applied to a data stream. The system comprises an evaluation device and a server. The evaluation device comprises processing circuitry; and memory circuitry storing instructions that, when executed by the processing circuitry, cause the evaluation device to: evaluate at least one parameter of the data stream or data content of the data stream, wherein the at least one parameter is indicative of a property that has an effect on how PET is applied; determine a change in the at least one parameter; generate a privacy signal based on the change in the at leastone parameter; establishing a signalling channel to the server, wherein the signalling channel is distinct from a data stream channel for transferring the data stream; and; and transmit the privacy signal over the signalling channel to the server to affect how the PET is applied to the data stream. The server comprises processing circuitry; and memory circuitry storing instructions that, when executed by the processing circuitry, cause the server to: establish the signalling channel to the evaluation device; and receive the privacy signal over the signalling channel from the evaluation device; adjust how the PET is applied to the data stream based on the privacy signal.

[0043] Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to "a / an / the element, apparatus, component, means, step, etc." are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Aspects and embodiments are now described, by way of example, with reference to the accompanying drawings, in which:

[0045] Fig 1 is a schematic diagram illustrating an environment in which embodiments presented herein can be applied;

[0046] Fig 2 is a schematic diagram illustrating a system according to embodiments presented herein;

[0047] Figs 3A-B are swimlane diagrams illustrating embodiments of methods for controlling how PET is applied to a data stream;

[0048] Fig 4 is a schematic diagram showing functional modules of the evaluation device (e.g. the content source device and / or the network device) of Fig 1;

[0049] Fig 5 is a schematic diagram showing functional modules of the server of Fig 1 according to one embodiment;

[0050] Fig 6 is a schematic diagram illustrating components of each one of the content source device, the network device and the server of Fig 1; and

[0051] Fig 7 shows one example of a computer program product comprising computer readable means.DETAILED DESCRIPTION

[0052] The aspects of the present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, in which certain embodiments of the invention are shown. These aspects may, however, be embodied in many different forms and should not be construed as limiting; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and to fully convey the scope of all aspects of invention to those skilled in the art. Like numbers refer to like elements throughout the description.

[0053] According to embodiments presented herein, it is provided a solution of adapting PET to characteristics of the content or data stream, in a context where a content source provides the data stream of content and PET is applied in a server. Parameter(s) of the content and / or data stream are monitored for changes for which an adapted PET would benefit. When such a change is detected, a separate signalling channel is established between the node that detects the change and server. The signalling channel is not the same as the data stream channel (over which the data stream is transferred). Significantly, the signalling channel is more reliable and / or faster, to allow the changed parameter to be communicated reliably, and preferably, prior to the data stream arriving at the server. In this way, the server can adapt its PET reliably and in time, to reduce overhead incurred when PET is applied to the data stream.

[0054] Fig 1 is a schematic diagram illustrating an environment in which embodiments presented herein can be applied.

[0055] A content source device 2 is any device capable of capturing or generating data content. The data content can e.g. be in the form of video, audio and / or sensor data. The sensor data can e.g. be environment sensors capturing temperature, humidityor other weather conditions. The sensor data could also be data related to XR, such as depth data, acceleration data, gyro data, orientation data, facial attributes, eye tracking data, pupil properties, iris characteristics, physiological data (heart rate, breathing, body temperature), body features, etc. The content source device 2 can e.g. be implemented in the form of a smartphone, a wearable device (e.g. smartglasses or other XR device), a tablet computer, a laptop computer, a stationary computer, stand-alone sensor device or any other device that can capture or generate data content. The data content is sent from the content source device 2 in the form of a data stream 13 towards a server 6 for applying PET, prior to the data content being provided to a content consumer 7. The content consumer can be any device (user device or server) that receives the data content after PET is applied.

[0056] Communication between the different entities in Fig 1 occurs via a communication network 9. The communication network 9 can be an internet protocol (IP) based network, i.e. based on IP packets. The network can e.g. comprise any one or more of a local wireless network, a cellular network, a wired local area network, a wide area network (such as the Internet), etc.

[0057] The data stream 13 is transmitted over a data stream channel 15 from the content source device 2 to the server 6. Hence, part of or all of PET processing of content from the content source device 2 is offloaded to the server 6. The content source device 2 can extract parameters of the data content, e.g. frame rate of video data content, bit rate of audio data content, sensor polling frequency, sampling rate, transmission rate, etc.

[0058] Optionally, a network device 3 is provided in the path from the content source device 2 to the server 6. The network device 3 can e.g. be a router, gateway, etc. that can monitor at least part of the data stream 13. The network device 3 can extract parameters reflecting network characteristics of the data stream, e.g. packet rate, data throughput, jitter, and packet interarrival time.

[0059] According to embodiments presented herein, the content source device 2 and / or the network device 3 monitors and evaluates the data stream 13 and / or the data content, and transmits signals based on the monitoring to the server 6 via a signallingchannel 16. Collectively, any one of the content source device 2 and / or the network device 3 is here denoted an evaluation device.

[0060] Once the data stream 13 reaches the server 6, the server 6 applies PET to preserve or enhance privacy of the data content in the data stream 13. The server 6 comprises a PET module 10, a policy manager 11 and a network manager 12 for applying PET. The server can be any suitable computer that can implement the aspects described herein that are performed by the server 6. For instance, the server 6 can be a cloud server and / or an edge server. A difference between the cloud server and the edge server is that the edge server is provided topologically closer to the content source device 2. The server 6 can also perform other processing that the content source device 2 has offloaded, e.g. XR processing such as SLAM (simultaneous localisation and mapping), etc.

[0061] The PET module 10 applies the PET on the data stream according to a given privacy policy and privacy budget. In addition, the PET module 10 adapts the privacy budget based on values of at least one parameter of the data stream, or the data content (of the data stream) received from an evaluation device over the signalling channel 16, as described in more detail below. The policy manager 11 deploys the privacy policy containing PET configuration and privacy budget information, by providing this to the PETs module 10. The network manager 12 offers information on an existing signalling channel 16 and / or receives requests for establishing or exploiting a signalling channel 16. The network manager 12 can be located either in the server 6 or in another network node of the communication network 9. The signalling channel 16 can be established via network APIs (application programming interfaces).

[0062] Fig 2 is a schematic diagram illustrating a system according to embodiments presented herein. A system 1 is provided that comprises the server 6 and an evaluation device (in the form of a content source device 2 and / or a network device 3), illustrated in Fig 1 and described above. The system 1 evaluates characteristics of the data content of the data stream and adapts PET based on changes in these characteristics.

[0063] Figs 3A-B are swimlane diagrams illustrating embodiments of methods for controlling how PET is applied to a data stream. Prior to commencing, a privacy policy has been deployed in the PET module 10 of the server 6 by the policy manager 11.

[0064] In an evaluate parameter(s) step 41, the evaluation device 2, 3 evaluates at least one parameter of the data stream or data content of the data stream. The at least one parameter is indicative of a property that has an effect on how PET is applied. For instance, the at least one parameter can be an indication of data rate, frequency of transmissions.

[0065] In one embodiment, this comprises evaluating a parameter based on data content of the data stream. For instance, the parameter based on the data content of the data stream can be a frame rate of video data content, or a bit rate of audio data content. In this embodiment, the evaluation device can e.g. be implemented in the content source device 2 that has access to the content data itself as well as metadata of the content data, when available.

[0066] In one embodiment, this comprises evaluating a parameter based on network characteristics of the data stream. For instance, the parameter based on the network characteristics of the data stream can be at least one of a packet rate, data throughput, and jitter. In this embodiment, the evaluation device can e.g. be implemented in the network device 3 that can might already have access to the network characteristics.

[0067] The evaluate parameter(s) step 41 is repeated until a change in an evaluated parameter is found, which is illustrated by the subsequent determine parameter change step 42.

[0068] In a determine parameter change step 42, the evaluation device 2, 3 determines a change in the at least one parameter. Optionally, the amount of change needs to exceed a pre-determined threshold. The threshold can be a constant or it can be expressed as a certain percentage.

[0069] In a generate privacy signal step 44, the evaluation device 2, 3 generates a privacy signal based on the change in the at least one parameter. The privacy signal can contain an identifier of the parameter and a value indicating the change and / or its newvalue. Optionally, the identifier of the parameter is implicitly derivable by the server 6, e.g. based on the identity of the evaluation device and / or the monitored content, in which case the identifier of the parameter can be omitted from the privacy signal. In one embodiment, the evaluation device also determines how the application of PET is affected by the change in the at least one parameter and derives a derived value that is included in the privacy signal. For instance, if an audio bitrate is doubled, an example of a derived value can be a bandwidth change factor, which in this example would have a value of two.

[0070] In an establish signalling channel step 46, the evaluation device 2, 3 establishes a signalling channel 16 to a server, wherein the signalling channel 16 is distinct from a data stream channel 15 for transferring the data stream. In other words, the signalling channel 16 is not the same as the data stream channel 15.

[0071] The signalling channel 16 is configured to transfer signals faster and / or more reliably than the data stream channel 15.

[0072] For instance, traffic on the signalling channel 16 or the signalling channel itself 16 can be configured to have a higher priority than traffic on the data stream channel 15. The priority can e.g. be indicated using flags in the IP header or TCP (transport control protocol) header, when applicable. Alternatively, the higher priority can be provided by selecting a bearer (when the signalling channel 16 is implemented in a cellular network) with appropriate priority or other classification.

[0073] Alternatively or additionally, traffic on the signalling channel 16, on average, has lower latency than traffic on the data stream channel 15.

[0074] In one embodiment, the signalling channel 16 and the data stream channel 15 can be provided using different network slices. Different network slices can be configured with different characteristics in terms of latency, reliability and / or bandwidth.

[0075] Alternatively, the signalling channel 16 and the data stream channel 15 are provided using different networks. For instance, the data stream channel 15 can be provided using a Wi-Fi network, while the signalling channel 16 is provided using anultra reliable and low latency communications (URLLC) channel in a 5G (fifth generation) cellular network.

[0076] The signalling channel 16 can be provided using low latency low loss scalable throughput (L4S). A dedicated bearer can be established for the signalling channel 16 using L4S capability by setting a L4S-capable bit in the IP header.

[0077] The signalling channel 16 and the data stream channel 15 can be distinguished from each other using user equipment route selection policy (URSP), allowing different traffic to be directed to different PDU (packet data unit) sessions and network slices.

[0078] In an establish signalling channel step 51 (corresponding to the establish signalling channel step 46 of the evaluation device 2, 3), the server 6 establishes a signalling channel 16 to an evaluation device 2, 3. This step is the server counterpart actions corresponding to the actions in the evaluation device 2, 3. As explained above, the signalling channel 16 is distinct from the data stream channel 15.

[0079] In a transmit privacy signal step 48, the evaluation device 2, 3 transmits the privacy signal over the signalling channel 16 to the server 6 to affect how the PET is applied to the data stream (for which the parameter change was detected). The method for the evaluation device 2, 3 then returns to the evaluate parameter(s) step 41, as long as the data stream is still provided by the content source device 2.

[0080] The privacy signal can e.g. be in the form of a key / value pair structure (e.g. JSON (javascript object notation)) or in the form of XML (extensible markup language), that includes the information described in step 44. Two examples of privacy signals are shown here:Privacy signal from content source devi ce { “timestamp” : “1234567890” , “devi ceiD” : “devi ceiD123” , “dataStreamApplD” : ”dataStreamAppl234” , “videoRate” : ”120”}Snippet 1: Example in JSON of a privacy signal from a content source devicePrivacy signal from network devi ce { “timestamp” : “1234567890” , “devi ceiD” : “devi ceiD123” , “dataStreamApplD” : ”dataStreamAppl234” , “packetRate” : ”30”}Snippet 2: Example in JSON of a privacy signal from a content source device

[0081] In a receive privacy signal step 52, the server 6 receives the privacy signal over the signalling channel from the evaluation device 2, 3.

[0082] In an adjust PET step 54, the server 6 adjusts how the PET is applied to the data stream based on the privacy signal. The adjusting 54 can comprise adjusting a privacy budget for the PET based on the privacy signal. The PET can be based on adding a noise component to the data content of the data stream. For instance, the PET can be based on differential privacy. Alternatively, the PET can be based on k-anonymity or 1- diversity.

[0083] In a separate process, not illustrated by Fig 3A, the PET (adjusted in the adjust PET step 54), is applied to the data stream from the content source device 2, prior to provided the data stream to the content consumer 7.

[0084] Looking now to Fig 3B, only new or modified steps, compared with embodiment covered by Fig 3A, will be described.

[0085] In an optional signal monitoring step 50, the server 6 sends a monitoring signal to the evaluation device 2, 3 to start monitoring. In other words, the server commands the evaluation device 2, 3 to start monitoring and send any parameter change via the signalling channel 16 (even though the signalling channel is not established at this stage) to the server 6. The monitoring signal can e.g. be in the form in the form of a key / value pair structure (e.g. JSON) or in the form of XML, that indicates to the receiver to start monitoring.Monitori ng signal to content source devi ce { “timestamp” : “1234567890” , “devi ceiD” : “devi ceiD123” , “dataStreamApplD” : ”dataStreamAppl234” , “videoRate” : [ “monitor” : ’’enabl e” ,“dedi catedchannel ” : “yes | url l c | 14s”] ,“audi oRate” : [“moni tor” : ”enabl e” ,“dedi catedchannel ” : “yes | url 1 c 114s”]}Snippet 3: Example in JSON of a monitoring signal to a content source deviceMonitori ng signal to network devi ce { “timestamp” : “1234567890” , “devi ceiD” : “devi ceiD123” , “dataStreamApplD” : ”dataStreamAppl234” “packetRate” : [ “monitor” : ’’enabl e” , “threshol d” : ”30” “dedi catedchannel ” : “yes | u rl 1 c 114s”] }Snippet 4: Example in JSON of a monitoring signal to a content source device

[0086] In an optional receive monitoring signal step 40, the evaluation device 2, 3 receives the monitoring signal and starts monitoring. The subsequent monitoring and signalling is described with reference to Fig 3A above.

[0087] An example is now presented to illustrate how embodiments presented herein can operate. In this example, privacy policy requirements for an XR application specifies that every period of 300 frames of a video stream have an allocated privacy budget of e (in this example for a differential privacy-based privacy protection method). Noise needs to be added to each frame and will consume 6 / 300 of the privacy budget. The video stream is initially provided at a frame rate of 30 frames per second (fps), whereby the budget will be consumed in 10 seconds if nothing changes. However, in this example, after 5 seconds, the video stream frame rate changes from 30 to 120 fps. If no action is taken, the budget will be consumed in 6.25 seconds (150 frames in 5 seconds at 3ofps and 150 frames in 1.25 seconds at i2ofps). Consequently 3.75 seconds of the videowindow would then have no privacy budget. By applying the solution according to embodiments presented herein, the extra information provided via the signalling channel will allow quick reconfiguration of the privacy budget for the last 3.75 seconds, either by adjusting the remaining budget or for allocating a new budget and starting the new window earlier. In this way, there is no gap in how PET is applied.

[0088] Hence, embodiments presented herein provide a solution where PET can be managed dynamically for streamed content in a proactive manner to avoid ill-effects of changed characteristics of the content or changed network characteristics.

[0089] Fig 4 is a schematic diagram showing functional modules of the evaluation device 2, 3 (e.g. the content source device 2 and / or the network device 3) of Fig 1 according to one embodiment. The modules are implemented using software instructions such as a computer program executing in the evaluation device 2, 3 Alternatively or additionally, the modules are implemented using hardware, such as any one or more of an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or discrete logical circuits. The modules correspond to the steps in the methods illustrated in Figs 3A-B.

[0090] A monitoring order receiver 70 corresponds to step 40. A parameter evaluator 71 corresponds to step 41. A parameter change determiner 72 corresponds to step 42. A privacy signal generator 74 corresponds to step 44. A signalling channel establisher 76 corresponds to step 46. A privacy signal transmitter 78 corresponds to step 48.

[0091] Fig 5 is a schematic diagram showing functional modules of the server 6 of Fig 1 according to one embodiment. The modules are implemented using software instructions such as a computer program executing in the server 6. Alternatively or additionally, the modules are implemented using hardware, such as any one or more of an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or discrete logical circuits. The modules correspond to the steps in the methods illustrated in Figs 3A-B.

[0092] A monitoring order transmitter 80 corresponds to step 50. A signalling channel establisher 81 corresponds to step 51. A privacy signal receiver 82 corresponds to step 52. A PET adjuster 84 corresponds to step 54.

[0093] Fig 6 is a schematic diagram illustrating components of each one of the content source device 2, the network device 3 and the server 6 of Fig 1. Processing circuitry 60 is provided using any combination of one or more of a suitable central processing unit (CPU), graphics processing unit (GPU), multiprocessor, neural processing unit (NPU), microcontroller, digital signal processor (DSP), etc., capable of executing software instructions 67 stored in memory circuitry 64, which can thus be a computer program product. The processing circuitry 60 could alternatively be implemented using an application specific integrated circuit (ASIC), field programmable gate array (FPGA), etc. The processing circuitry 60 can be configured to execute embodiments of methods described with reference to Figs 3A-B above.

[0094] The memory circuitry 64 can be any combination of random-access memory (RAM) and / or read-only memory (ROM). The memory circuitry 64 also comprises non- transitory persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, solid-state memory or even remotely mounted memory.

[0095] A data memory 66 is also provided for reading and / or storing data during execution of software instructions in the processing circuitry 60. The data memory 66 can be any combination of RAM and / or ROM.

[0096] An I / O interface 62 is provided for communicating with external and / or internal entities using wired communication, e.g. based on Ethernet, optical fibre, and / or wireless communication, e.g. Wi-Fi, Bluetooth, Bluetooth Low Energy, and / or a cellular network, complying with any one or a combination of sixth generation (6G) mobile networks, next generation mobile networks (5G), LTE (Long Term Evolution), UMTS (Universal Mobile Telecommunications System) utilising W-CDMA (Wideband Code Division Multiplex), or any other current or future wireless network, as long as the principles described hereinafter are applicable.

[0097] Other components are omitted in order not to obscure the concepts presented herein.

[0098] Fig 7 shows one example of a computer program product 90 comprising computer readable means. On this computer readable means, a computer program 91 can be stored in a non-transitory memory. The computer program can cause processing circuitry to execute a method according to embodiments described herein. In this example, the computer program product 90 is in the form of a removable solid-state memory, e.g. a Universal Serial Bus (USB) drive. As explained above, the computer program product could also be embodied in a memory of a device, such as the computer program product 64 of Fig 6. While the computer program 91 is here schematically shown as a section of the removable solid-state memory, the computer program can be stored in any way which is suitable for the computer program product, such as another type of removable solid-state memory, or an optical disc, such as a CD (compact disc), a DVD (digital versatile disc) or a Blu-Ray disc.

[0099] The aspects of the present disclosure have mainly been described above with reference to a few embodiments. However, as is readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the invention, as defined by the appended patent claims. Thus, while various aspects and embodiments have been disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for purposes of illustration and are not intended to be limiting, with the true scope being indicated by the following claims.

Claims

CLAIMS1. A method for controlling how privacy enhancing technology, PET, is applied to a data stream, the method being performed by an evaluation device (2, 3), the method comprising: evaluating (41) at least one parameter of the data stream or data content of the data stream, wherein the at least one parameter is indicative of a property that has an effect on how PET is applied; determining (42) a change in the at least one parameter; generating (44) a privacy signal based on the change in the at least one parameter; establishing (46) a signalling channel (16) to a server (6), wherein the signalling channel (16) is distinct from a data stream channel (15) for transferring the data stream; and transmitting (48) the privacy signal over the signalling channel (16) to the server (6) to affect how the PET is applied to the data stream.

2. The method according to claim 1 wherein the evaluating (41) at least one parameter comprises evaluating a parameter based on data content of the data stream.

3. The method according to claim 2, wherein the parameter based on the data content of the data stream is a frame rate of video data content, or a bit rate of audio data content.

4. The method according to claim 1 wherein the evaluating (41) at least one parameter comprises evaluating a parameter based on network characteristics of the data stream.

5. The method according to claim 4, wherein the parameter based on the network characteristics of the data stream is at least one of a packet rate, data throughput, and jitter.

6. The method according to any one of the preceding claims, wherein traffic on the signalling channel (16) has higher priority than traffic on the data stream channel (15).

7. The method according to any one of the preceding claims, wherein traffic on the signalling channel (16), on average, has lower latency than traffic on the data stream channel (15).

8. The method according to any one of the preceding claims, wherein the signalling channel (16) and the data stream channel (15) are provided using different network slices.

9. The method according to any one of the preceding claims, wherein the signalling channel (16) and the data stream channel (15) are provided using different networks.

10. The method according to any one of the preceding claims, wherein the signalling channel (16) is provided using low latency low loss scalable throughput, L4S.

11. The method according to any one of the preceding claims, wherein the signalling channel (16) and the data stream channel (15) are distinguished from each other using user equipment route selection policy, URSP.

12. An evaluation device (2, 3) for controlling how privacy enhancing technology, PET, is applied to a data stream, the evaluation device (2, 3) comprising: processing circuitry (60); and memory circuitry (64) storing instructions (67) that, when executed by the processing circuitry, cause the evaluation device (2, 3) to: evaluate at least one parameter of the data stream or data content of the data stream, wherein the at least one parameter is indicative of a property that has an effect on how PET is applied; determine a change in the at least one parameter; generate a privacy signal based on the change in the at least one parameter; establish a signalling channel (16) to a server, wherein the signalling channel (16) is distinct from a data stream channel (15) for transferring the data stream; and transmit the privacy signal over the signalling channel (16) to the server to affect how the PET is applied to the data stream.

13. The evaluation device (2, 3) according to claim 12 wherein the instructions to evaluate at least one parameter comprise instructions (67) that, when executed by theprocessing circuitry, cause the evaluation device (2, 3) to evaluate a parameter based on data content of the data stream.

14. The evaluation device (2, 3) according to claim 13, wherein the parameter based on the data content of the data stream is a frame rate of video data content, or a bit rate of audio data content.

15. The evaluation device (2, 3) according to claim 12 wherein the instructions to evaluate at least one parameter comprise instructions (67) that, when executed by the processing circuitry, cause the evaluation device (2, 3) to evaluate a parameter based on network characteristics of the data stream.

16. The evaluation device (2, 3) according to claim 15, wherein the parameter based on the network characteristics of the data stream is at least one of a packet rate, data throughput, and jitter.

17. The evaluation device (2, 3) according to any one of claims 12 to 16, wherein traffic on the signalling channel (16) has higher priority than traffic on the data stream channel (15)-18. The evaluation device (2, 3) according to any one of claims 12 to 17, wherein traffic on the signalling channel (16), on average, has lower latency than traffic on the data stream channel (15).

19. The evaluation device (2, 3) according to any one of claims 12 to 18, wherein the signalling channel (16) and the data stream channel (15) are provided using different network slices.

20. A computer program (67, 91) for controlling how privacy enhancing technology, PET, is applied to a data stream, the computer program comprising computer program code which, when executed on an evaluation device (2, 3) causes the evaluation device (2, 3) to: evaluate at least one parameter of the data stream or data content of the data stream, wherein the at least one parameter is indicative of a property that has an effect on how PET is applied;determine a change in the at least one parameter; generate a privacy signal based on the change in the at least one parameter; establish a signalling channel (16) to a server (6), wherein the signalling channel(16) is distinct from a data stream channel (15) for transferring the data stream; and transmit the privacy signal over the signalling channel (16) to the server (6) to affect how the PET is applied to the data stream.

21. A computer program product (64, 90) comprising a computer program according to claim 20 and a computer readable means comprising non-transitory memory in which the computer program is stored.

22. A method for controlling how privacy enhancing technology, PET, is applied to a data stream, the method being performed by a server (6), the method comprising: establishing (51) a signalling channel (16) to an evaluation device (2, 3), wherein the signalling channel (16) is distinct from a data stream channel (15) for transferring the data stream; receiving (52) a privacy signal over the signalling channel from the evaluation device (2, 3); and adjusting (54) how the PET is applied to the data stream based on the privacy signal.

23. The method according to claim 22, wherein the adjusting (54) comprises adjusting a privacy budget for the PET based on the privacy signal.

24. The method according to claim 22 or 23, wherein the PET is based on adding a noise component to the data content of the data stream.

25. The method according to claim 24, wherein the PET is based on differential privacy.

26. The method according to claim 22, wherein the PET is based on k-anonymity.

27. The method according to claim 22, wherein the PET is based on 1-diversity.

28. A server (6) for controlling how privacy enhancing technology, PET, is applied to a data stream, the method comprising:processing circuitry (60); and memory circuitry (64) storing instructions (67) that, when executed by the processing circuitry, cause the server (6) to: establish a signalling channel (16) to an evaluation device (2, 3), wherein the signalling channel (16) is distinct from a data stream channel (15) for transferring the data stream; receive a privacy signal over the signalling channel from the evaluation device (2, 3); and adjust how the PET is applied to the data stream based on the privacy signal.

29. The server (6) according to claim 28, wherein the instructions to adjust comprise instructions (67) that, when executed by the processing circuitry, cause the server (6) to adjust a privacy budget for the PET based on the privacy signal.

30. The server (6) according to claim 28 or 29, wherein the PET is based on adding a noise component to the data content of the data stream.

31. A computer program (67, 91) for controlling how privacy enhancing technology, PET, is applied to a data stream, the computer program comprising computer program code which, when executed on a server (6) causes the server (6) to: establish a signalling channel (16) to an evaluation device (2, 3), wherein the signalling channel (16) is distinct from a data stream channel (15) for transferring the data stream; receive a privacy signal over the signalling channel from the evaluation device (2, 3); and adjust how the PET is applied to the data stream based on the privacy signal.

32. A computer program product (64, 90) comprising a computer program according to claim 31 and a computer readable means comprising non-transitory memory in which the computer program is stored.

33. A system (1) for controlling how privacy enhancing technology, PET, is applied to a data stream, the system (1) comprising an evaluation device (2, 3) and a server (6); the evaluation device (2, 3) comprising processing circuitry (60); andmemory circuitry (64) storing instructions (67) that, when executed by the processing circuitry, cause the evaluation device (2, 3) to: evaluate at least one parameter of the data stream or data content of the data stream, wherein the at least one parameter is indicative of a property that has an effect on how PET is applied; determine a change in the at least one parameter; generate a privacy signal based on the change in the at least one parameter; establishing a signalling channel (16) to the server (6), wherein the signalling channel is distinct from a data stream channel (15) for transferring the data stream; and; and transmit the privacy signal over the signalling channel (16) to the server to affect how the PET is applied to the data stream; wherein the server (6) comprises processing circuitry (60); and memory circuitry (64) storing instructions (67) that, when executed by the processing circuitry, cause the server (6) to: establish the signalling channel (16) to the evaluation device (2, 3); receive the privacy signal over the signalling channel (16) from the evaluation device (2, 3); and adjust how the PET is applied to the data stream based on the privacy signal.

Images