CityOS: Privacy Architecture for Urban Sensing
2026-05-04 • Operating Systems
Operating Systems
AI summaryⓘ
The authors created CityOS, a system that helps cities manage data from cameras and sensors while protecting people's privacy. CityOS organizes data access into three levels that limit what information apps can see, from real-time local data to city-wide summaries with privacy measures. It runs apps safely by isolating them and tracking privacy use to keep data secure. The authors tested CityOS with various city apps and found it works well while respecting privacy rules.
urban sensingdifferential privacyedge computingAPI tiersdata aggregationprivacy budgetsephemeral containersreal-time datalongitudinal statisticssensor infrastructure
Authors
Giorgio Cavicchioli, Mark Chen, Navid Salami Pargoo, Shuren Xia, Xiaotian Zhou, Roxana Geambasu, Jason Nieh, Jorge Ortiz
Abstract
Cities are rapidly deploying sensing infrastructure -- cameras, environmental sensors, and connected kiosks -- that continuously observe public spaces, yet they lack a system architecture governing how applications access, aggregate, and retain this data, creating privacy risks and preventing consistent policy enforcement. We present CityOS, an operating system for urban sensing that mediates application access to sensor data through a three-tier API inspired by structured, privacy-conscious web interfaces. The tiers expand the spatial scope of data access while imposing progressively stronger privacy constraints: On-Scene supports real-time sensing with raw data confined to the local context; Single-Locality Aggregation enables differentially private longitudinal statistics at a fixed location; and Cross-Locality Aggregation supports citywide analytics via aggregation across locations, with user devices enforcing per-user privacy budgets. CityOS runs as an edge runtime that executes untrusted applications in ephemeral containers, enforcing these policies and providing transparency via broadcasts of differential privacy loss. We implement CityOS and applications across all tiers -- including pedestrian safety alerts, real-time and forecast parking availability, traffic dashboards, and subway trajectory measurement -- and show that it supports practical streetscape applications while enforcing strong privacy.