A privacy-aware access control system

Issue title: 20th Annual IFIP WG 11.3 Working Conference on Data and Applications Security (DBSec'06)

Article type: Research Article

Authors: Ardagna, C.A. | Cremonini, M. | De Capitani di Vimercati, S. | Samarati, P.

Affiliations: Università degli Studi di Milano, Dipartimento di Tecnologie dell'Informazione, Via Bramante 65, 26013 Crema, Italy. E-mail: ardagna@dti.unimi.it, cremonini@dti.unimi.it, decapita@dti.unimi.it, samarati@dti.unimi.it

Abstract: The protection of privacy is an increasing concern in our networked society because of the growing amount of personal information that is being collected by a number of commercial and public services. Emerging scenarios of user–service interactions in the digital world are then pushing toward the development of powerful and flexible privacy-aware models and languages. This paper aims at introducing concepts and features that should be investigated to fulfill this demand. We identify different types of privacy-aware policies: access control, release and data handling policies. The access control policies govern access/release of data/services managed by the party (as in traditional access control), and release policies govern release of personal identifiable information (PII) of the party and specify under which conditions it can be disclosed. The data handling policies allow users to specify and communicate to other parties the policy that should be enforced to deal with their data. We also discuss how data handling policies can be integrated with traditional access control systems and present a privacy control module in charge of managing, integrating, and evaluating access control, release and data handling policies.

Keywords: Access control, privacy, data handling policies

DOI: 10.3233/JCS-2008-0328

Journal: Journal of Computer Security, vol. 16, no. 4, pp. 369-397, 2008