INTRODUCTION.

Technology can behave as a set of privacy threats, but IPP-AXNG neutralizes them in all domains. Some threats from technologies that harm privacy and are neutralized by IPP-AXNG are: (i) Threats promoted by surveillance through a wide variety of vulnerable elements such as vulnerable operating systems (iOS on iPhones, Android, Windows, Linux, Unix, Solaris, Android Auto, Apple CarPlay, etc.), apps/APIs, social media, web browsing, instant messaging (WhatsApp, Telegram, etc.), emails, webcams, satellites, X-ray/shortwave scanners at airports, cameras on smartphones, smartwatches, iPods/iPads, laptops/PCs/Macs, tablet PCs, surveillance cameras in streets/inside garages, building entrances, department stores/financial institutions, surveillance via Google mobile vehicles that travel the streets, stealthy drones that fly over cities/areas, etc. (ii) Threats promoted by web servers. Web servers can read our behaviors and generate profiles of our personality. Some of the data that can be obtained from the logs of the most typical web servers after distilling their raw information includes: information about the requested URL, the date and time of the request, the user agent used (Chrome, Opera, Safari, Mozilla Firefox), and the user's IP and MAC address (using reverse DNS techniques, we can obtain the user's hostname, office number, geographic location via geolocation, referrer header, etc.). If access to the log is unavailable, JavaScript can be used, which runs on the client and not the server and can access the clipboard, but IPP-AXNG neutralizes such threats/cyberattacks. (iii) Threats promoted by web browsers. Cookies are files that use a unique identifier, which may not expire for a long time, allowing tracking when the IP address changes. IPP-AXNG allows "private browsing." Cross-requests occur when a user explicitly visits website A, but the browser It has instructions to also obtain content from websites B, C, D, etc., allowing it to track our browsing habits. Sneaky cookies or flash LSOs (Local Shared Objects) or flash cookies are a very common but little-known type of cookie. They are difficult to delete and have a large capacity. Website operators can surreptitiously use them to recreate traditional cookies with a unique identifier. (iv) Threats promoted by unintentional data leakage. These include, for example: (a) Threats promoted by Office metadata, which is data about data, usually hidden. Examples include your name, initials, user ID, institution or company name, your computer's name (hostname, MAC address), the name of the network server or hard drive where the file is stored, the names of previous authors of the document, document revisions, document versions, template information, possible hidden text, etc. Data Leakage Protection (DLP) mechanisms, both software and hardware-software, neutralize leaks. (a) Hidden data. (b) Threats promoted by image metadata, such as the date the photo was taken, the subject's name (in the file name), the location (in GPS coordinates), the photographer's name, the original thumbnail, etc. (v) Threats promoted by intentional data leaks using Social Networks. IPP-AXNG defends against/guides/neutralizes threats against public entities on the Web via Social Networks, since it is not private, it is permanent, and it is for everyone. (vi) Threats promoted by cloud computing (cloud computing, edge computing, fog computing), especially if it is public or semi-public. (vii) Privacy invasions promoted by the use of automobiles. There is a growing trend of placing GPS/Galileo trackers, OBD recorders, voluntary black boxes, etc., in vehicles. (viii) Privacy invasions promoted by the use of transportation systems (horizontal-vertical). For example: the use of airplanes, buses, boats, trains, subways, trams, elevators, automated escalators, etc.

PRIVACY VIOLATIONS BLOCKED BY THE IPP-AWNG.

Privacy violations include: (i) Improper acquisition of personal information, including its access, collection, and distribution. (ii) Misuse of information, including its use for reasons other than those explicitly specified for which it was collected or its transfer to other parties. (iii) Unsolicited requests for personal data. (iv) Irregular storage of information. The retention period is the length of time personal information is kept; it should not be kept longer than necessary to fulfill the purpose for which it was collected. IPP-AXNG are responsible for acting, defending, neutralizing, and blocking such violations.
The concept of privacy encompasses a wide variety of interrelated values, rights, and interests. Numerous definitions of privacy exist, such as: the right to be alone; informational self-determination (i.e., gaining control over one's informational environment; not giving away sensitive information; not trusting others (first verifying them thoroughly) to act in accordance with our interests); and freedom from unreasonable restrictions on the construction of one's identity. It is a fact that numerous privacy threats currently exist that are neutralized by IPP-AXNG, such as collection (through social engineering), processing/reverse engineering, use, dissemination, and invasion of privacy. For most businesses, the most relevant subset of privacy is information privacy, sometimes referred to as data protection. Information privacy is the ability of an individual or entity to exercise full control and regulation over the illegal collection, use, and disclosure of their personal information. Personal information encompasses any information about an identifiable individual, such as name, address, age, ethnicity, family members, friends, neighbors, medical, credit, and legal records, information on purchases and sales, GPS/G1G/G2G location data, and identification numbers (such as employee numbers, national identity card numbers, social security numbers, telephone numbers, and email addresses).
IPP-AXNG integrates numerous proactive defense techniques such as: highly robust nested anonymity, steganography combined with post-quantum encryption, the use of intertwined subliminal channels, the use of multi-layered Deception technology, mechanisms for nullifying/neutralizing/blocking lateral movement, attack surfaces, vulnerabilities, and suspicious behavior, preventing account control via malware, incorporating mimicry-concealment technologies based on blending into the environment to hide from any type of fixed/nomadic illegal tracker/capture device, integrating perception distorters so that no cyber-attacker can know what, where, when, who, content, how, why, etc., using highly uncorrelated pseudonyms, mechanisms to prevent correlation and linking, using observability/monitoring/capture mechanisms, redundant mechanisms to prevent illegally knowing the location/time, and using OTR (Off-The-Record) cybersecurity, which in turn encompasses Plausible denial (one cannot prove that someone said something) and forward secrecy (once communication is secured, it cannot be decrypted, for example, through the use of ephemeral, nested cryptographic keys/algorithms) are integrated with anticipatory/proactive defense mechanisms such as OT/ZK/DAIM/ZT, etc.
IPP-AXNG integrates numerous defense strategies, tactics, and techniques from a data protection perspective, incorporating redundant mechanisms to select, control, and enable self-determination at the level of total information. It allows for comprehensive personal control over the collection, use, and disclosure of any type of recorded information about an identifiable individual. IPP-AXNG integrates cybersecurity (encompassing all possible functionalities: ZT/ZK/DAIM, multi-factor/bidirectional authentication, data integrity, multidimensional confidentiality (post-quantum unbreakable nested encryption/hierarchical tokenization/multiple subliminal channels/deep mimicry with the environment/multi-domain nested anonymization/masking/), availability, non-repudiation, access control, audit logging) as well as equitable information management strategies based on defense bots (such as accountability, identification of purposes, informed and unambiguous consent supervised by the IPP-AXNG, limitation of collection/use/disclosure/retention of information, accuracy of data, etc.). Authentication (with login-password, keys, tokens, smartcards, biometrics, location, time frame), authorization (with role-based models and permissions to read-write data), and post-quantum encryption in combination with steganography-anonymity and the use of subliminal channels (to prevent clandestine eavesdropping and reading during transmission, storage, and processing) prevents cyber attackers from capturing anonymous data, drastically hindering re-identification (which consists of correlating the unique identifiable observation with location pseudonyms).

STRATEGIES USED BY IPP-AXNG AGAINST CYBERATTACKS ON PRIVACY.
(1) Anonymous payment mechanisms. They use multiple anonymization mechanisms/subliminal processes/transactional transfer technology (OT/ZK, etc.) to prevent the buyer's identity from being identified.
(2) Trusted third party or TTP/Proxy networks. This term refers to an independent third party, such as an IPP-AXNG, that is trusted by both the user and the service provider. It may hold the master keys that correlate digital pseudonyms with the real identities of its users. A digital pseudonym could be a user's real identity hidden with the master keys secretly held by the TTP in the form of an IPP-AXNG.
(3) Filtering mechanisms. These include: (i) Spam filters. They block unwanted email. (ii) Cookie cutters. They block all types of cookies (even the most pervasive and invisible ones). (iii) Pop-up filters. They block pop-up windows. (iv) HTTP header filters. They block sensitive information. (v) Banner ad filters. They block ads. (vi) Pop-up graphic filters, etc. (vii) Spyware killers. They block downloaders without user consent and programs that collect sensitive information and send it to malicious websites. (viii) IPP-AXNG neutralizes auto-run/backdoor/info-stealer/Trojans/adware/etc.
(4) Anonymity/encryption/steganography/mimicry/subliminal actions strategies. Entities/individuals increasingly desire freedom of expression, private electronic voting, privacy while browsing the web, privacy while shopping online, no geolocation tracking, etc. But communications can be correlated by IP/MAC addresses and messages. Therefore, anonymity mechanisms based on encryption, re-encryption proxies that randomize encrypted messages, and IP/MAC address concealment are needed. IPP-AXNGs act as remailers for anonymity, suppressing the identification header of an email before sending it to the recipient. IPP-AXNGs utilize re-encryption, anonymization, multi-dimensional mimicry, etc.
(5) Identity Protectors/Fixed-Nomadic. The identity of every user entity is replaced by some type of identity protector token that separates the true identity from the details of the transactions carried out. An identity protector can be seen as a protective element that controls the release of an individual entity's true identity to processes within any information ecosystem. Its effect is to separate the true identity and replace it with a changing, multiple pseudo-identity. IPP-AXNGs use identity protectors to safeguard the interests of every user entity. One of the most important functions is to convert a user entity's real identity into a set of pseudo-identities (multiple, continuously changing), that is, alternative digital identities that the user entity can adopt when operating in all types of digital ecosystems. Alternative identities traditionally used in banking systems, such as bank account numbers, national identity cards, social security or insurance numbers, employee IDs, etc., cannot be considered pseudo-identities since they easily correlate with an entity's true identity. IPP-AXNG uses multi-dimensional identity protectors that generate appropriate pseudo-identities when the entity needs them for its defense. Identity protectors perform functions such as: (i) Generating changing pseudo-identities. (ii) Converting pseudo-identities into real identities when there is no threat. (iii) Combating all types of cyberattacks on privacy, cyber fraud, and misuse. The identity protector can perform functions such as revealing the real identity to certain entities after applying Zero Trust (ZK/ZT) mechanisms. It can use services or conduct anonymous transactions, thus protecting privacy. The identity protector creates domains: (a) Identity Domain, where the user's real identity is known by the IPP-AXNG; and (b) Pseudo-domains, where the user's real identity is unknown. The identity protector's functions separate these two domains and can be applied anywhere within a digital ecosystem, protecting personal data.

DECEPTION/SOCIAL ENGINEERING MECHANISMS NULLIFIED BY IPP-AXNG.

Among the cyberattacks, malicious strategies, tactics, techniques, and mechanisms that IPP-AXNG counters, blocks, prevents, and neutralizes well in advance are: (1) Phishing (or Email Phishing). This uses email to deliver deceptive messages (to trick the victim into clicking on links, scanning QR codes, calling malicious phone numbers, or using explanations designed to confuse the victim into giving away sensitive information or causing infections) with the aim of damaging privacy and cybersecurity. It can be mass-based (Phishing) or targeted (Spear-Phishing). (2) Smishing (or SMS-Phishing). This type of phishing uses SMS text messages to deliver malicious messages from dangerous, disguised numbers. They deceive the victim into clicking on links, calling malicious numbers, or contacting a malicious individual to hand over private information/credentials. (3) Vishing (or Voice-Phishing or Voice-over-IP (VoIP)). This is a phishing cyberattack/fraudulent practice that uses conventional telephone lines or instant messaging to steal information by deceiving the victim into providing sensitive/private information such as financial or useful information like their identity. Cyber ​​attackers make automated mass phone calls to a very large group of people, often using text-to-speech synthesizers, requesting private/sensitive information to carry out fraudulent activities on the accounts of the intended victims. IPP-AXNG prevents/neutralizes cyber attackers from spoofing the calling phone number to make it appear as if it comes from a bank, legitimate institution, or trusted individuals. (4) Quishing (or QRS-Phishing). It is a phishing cyberattack that uses malicious QR codes to access the victim's private information. The victim may scan malicious QR codes received via email or found on the street (for example, for bicycle rentals) or inside businesses to gain their trust and deceive them into compromising their bank accounts. (5) - Whaling (or CEO Fraud). This is a cyberattack using spear-phishing or targeted phishing techniques, involving the falsification of email addresses of executives and other high-level individuals to deceive and extract private/sensitive information from lower-level and even high-level victims. CEO Fraud consists of sending deceptive emails from spoofed high-level executives to trick other executives or lower-level employees into sending money to external accounts or other sensitive information such as their passwords, order books, etc. (6) - Spoofing (or Identity Theft). It uses techniques through which a privacy cyber attacker impersonates a different entity by falsifying data, voice, or video in a communication. “IDN Spoofing” or “Homograph Cyber ​​Attacks” enable the exploitation of Internationalized Domain Names (IDNs), allowing cyber attackers to create fake websites with visually identical addresses (using invisible characters) to those of legitimate users. These cyber attacks have been used to disguise malicious URLs using open URL redirects on trusted websites. Even SSL/TLS digital certificates cannot protect against these cyber attacks without IPP-AXNG, as cyber attackers can acquire valid certificates and alter the content to make them appear as genuine websites or support SSL/TLS-free phishing sites. (7) Hijacking. They enable a cyber attacker to seize or steal something. It's a very broad concept that can be applied to various areas, including information theft, hijacking network connections, terminal sessions, services, modems, and more. Page hijacking involves redirecting users to malicious websites or using exploit kits to compromise legitimate websites using cross-site scripting (CSC). Cyber ​​attackers insert exploit kits like MPack to compromise websites and exploit legitimate users when they visit those servers. Page hijacking can also involve inserting malicious inline frames that allow exploit kits to be loaded. This tactic is used in conjunction with watering-hole attacks on corporate targets, which IPP-AXNG neutralizes. (8)-IPP-AXNG also neutralize all types of perverse disinformation/MMD actions and malicious influence operations.

FINAL ASPECTS.
IPP-AXNG protectors operate redundantly using a growing number of AI layers, technologies, dimensions, strategies, tactics, techniques, locations, temporal/frequency action points, mobile and fixed elements, etc., in a fully unified manner (operating as a single, fully autonomous and resilient whole), with maximum fault tolerance/cyber-resilience through unconventional predictive/preventive anticipation. This allows them to anticipate all possible attempts by cyber attackers and all types of passive/active privacy violators.
REFERENCES.
- Areitio, J. “Information Security: Networks, Computing and Information Systems”. Cengage Learning-Paraninfo. 2023.
- Areitio, J. “Reprogramming of Offensive Cyberattacks by the DAIM/MIAD for their Neutralization”. Conectronica Magazine. No. 254. Feb-2023.
- Matsumi, H., Dara Hallinan, D., Dimitrova, D., Kosta, E. and De Hert, P. “Data Protection and Privacy, Volume 15: In Transitional Times (Computers, Privacy and Data Protection)”. Ed.‎ Hart Publishing-2023.
- Onofri, S., Onofri, D., and Meucci, M. “Attacking and Exploiting Modern Web Applications: Discover the Mindset, Techniques, and Tools to Perform Modern Web Attacks and Exploitation.” Ed.‎-Packt Publishing-2023.
- Blokdyk, G. “Protection of Privacy by Design Standard Requirements”. Ed. 5STARCooks-2021.
- Smith: JEH “The Internet Is Not What You Think It Is: A History, a Philosophy, a Warning.” Ed.‎-Princeton University Press-2023.
- Thorgersen, S. and Silva, PI “Keycloak - Identity and Access Management for Modern Applications: Harness the Power of Keycloak, OpenID Connect, and OAuth 2.0 to Secure Applications”. 2nd Edition. Ed.‎-Packt Publishing-2023.
- Gupta, I. “Operationalizing Expectations and Mapping Challenges of Information-Privacy and Data-Protection-Measures: A Machine-generated Literatute Overview.” Springer-2024.

Author: Prof. Dr. Javier Areitio Bertolín – Director of the Networks and Systems Research Group.