Article

Privacy-aware role based access control

Authors:

Alberto Trombetta,

Jorge LoboAuthors Info & Claims

SACMAT '07: Proceedings of the 12th ACM symposium on Access control models and technologies

Pages 41 - 50

https://doi.org/10.1145/1266840.1266848

Published: 20 June 2007 Publication History

Abstract

Privacy has been acknowledged to be a critical requirement for many business (and non-business) environments. Therefore, the definition of an expressive and easy-to-use privacy related access control model, based on which privacy policies can be specified, is crucial. In this work we introduce a family of models (P-RBAC) that extend the well known RBAC model in order to provide full support for expressing highly complex privacy-related policies, taking into account features like purposes and obligations. We also compare our work with access control and privacy policy frameworks such as P3P, EPAL, and XACML.

References

[1]

The enterprise privacy authorization language(epal 1.1). IBM Zurich Research Laboratory, Switzerland. Available at http://www.zurich.ibm.com/security/enterprise-privacy/epal/.

[2]

Amazon.com. Amazon privacy notice. Available at http://www.amazon.com/exec/obidos/tg/browse/-/468496/102-8997954-0573735.

[3]

A. H. Anderson. A comparison of two privacy policy languages: Epal and xacml. In SWS '06: Proceedings of the 3rd ACM workshop on Secure web services, pages 53--60, New York, NY, USA, 2006. ACM Press.

Digital Library

[4]

A. Barth, A. Datta, J. C. Mitchell, and H. Nissenbaum. Privacy and contextual integrity: Framework and applications. In SP '06: Proceedings of the 2006 IEEE Symposium on Security and Privacy (S&P'06), pages 184--198, Washington, DC, USA, 2006. IEEE Computer Society.

Digital Library

[5]

A. Barth, J. C. Mitchell, and J. Rosenstein. Conflict and combination in privacy policy languages. In WPES '04: Proceedings of the 2004 ACM workshop on Privacy in the electronic society, pages 45--46, New York, NY, USA, 2004. ACM Press.

Digital Library

[6]

Blizzard.com. Blizzard entertainment online privacy policy. Available at http://www.blizzard.com/privacy.shtml.

[7]

J.-W. Byun and N. Li. Purpose based access control for privacy protection in relational database systems. The VLDB Journal The International Journal on Very Large Data Bases, Sep 2006.

Digital Library

[8]

R. Chandramouli. A framework for multiple authorization types in a healthcare application system. In ACSAC '01: Proceedings of the 17th Annual Computer Security Applications Conference, page 137, Washington, DC, USA, 2001. IEEE Computer Society.

Digital Library

[9]

eBay.com. ebay privacy policy. Available at http://pages.ebay.com/help/policies/privacypolicy.html.

[10]

Federal Trade Commision. Children's online privacy protection act of 1998. Available at http://www.cdt.org/legislation/105th/privacy/coppa.html.

[11]

D. F. Ferraiolo, R. Sandhu, S. Gavrila, D. R. Kuhn, and R. Chandramouli. Proposed nist standard for role-based access control. ACM Trans. Inf. Syst. Secur., 4(3):224--274, 2001.

Digital Library

[12]

S. Fischer-Hubner. IT-security and privacy: design and use of privacy-enhancing security mechanisms. Springer-Verlag New York, Inc., New York, NY, USA, 2001.

Digital Library

[13]

Q. He. Privacy enforcement with an extended role-based access control model. NCSU Computer Science Technical Report TR-2003-09, February 28,2003.

Digital Library

[14]

G. Karjoth and M. Schunter. A privacy policy model for enterprises. In CSFW, pages 271--281, 2002.

Digital Library

[15]

OASIS. Core and hierarchical role based access control (rbac) profile of xacml v2.0. Available at http://www.oasis-open.org/.

[16]

OASIS. extensible access control markup language (xacml) 2.0. Available at http://www.oasis-open.org/.

[17]

OASIS. Hierarchical resource profile of xacml v2.0. Available at http://www.oasis-open.org/.

[18]

OASIS. Privacy policy profile of xacml v2.0. Available at http://www.oasis-open.org/.

[19]

Organisation for Economic Co-operation and Development. Oecd guidelines on the protection of privacy and transborder flows of personal data of 1980. Available at http://www.oecd.org/.

[20]

C. S. Powers. Privacy promises, access control, and privacy management. In ISEC '02: Proceedings of the Third International Symposium on Electronic Commerce, page 13, Washington, DC, USA, 2002. IEEE Computer Society.

Digital Library

[21]

E. B. J. L. Qun Ni, Alberto Trombetta. Privacy aware role-based access control. CERIAS Technical Report.

[22]

R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E.Youman. Role-based access control models. IEEE Computer, 29(2):38--47, 1996.

Digital Library

[23]

C. Shankar and R. Campbell. A policy-based management framework for pervasive systems using axiomatized rule-actions. In NCA '05: Proceedings of the Fourth IEEE International Symposium on Network Computing and Applications, pages 255--258, Washington, DC, USA, 2005. IEEE Computer Society.

Digital Library

[24]

TRUSTe.org. An independent, nonprofit enabling trust based on privacy for personal information on the internet. Available at http://www.truste.org/.

[25]

United State Department of Health. Health insurance portability and accountability act of 1996. Available at http://www.hhs.gov/ocr/hipaa/.

[26]

U.S. Senate Committee on Banking, Housing, and Urban Affairs. Information regarding the gramm-leach-bliley act of 1999. Available at http://banking.senate.gov/conf/.

Cited By

Shrivastava SSrikanth T(2023)A Comprehensive Consent Management System for Electronic Health Records in the Healthcare EcosystemInformation Security and Privacy in Smart Devices10.4018/978-1-6684-5991-1.ch007(194-233)Online publication date: 31-Mar-2023
https://doi.org/10.4018/978-1-6684-5991-1.ch007
Shrivastava SSrikanth T(2021)A Dynamic Access Control Policy for Healthcare Service Delivery in Healthcare Ecosystem using Electronic Health Records2021 International Conference on COMmunication Systems & NETworkS (COMSNETS)10.1109/COMSNETS51098.2021.9352812(662-667)Online publication date: 5-Jan-2021
https://doi.org/10.1109/COMSNETS51098.2021.9352812
Ghofrani FAmini M(2020)Privacy Preserving Dynamic Access Control Model with Access Delegation for eHealthSignal and Data Processing10.29252/jsdp.17.3.10917:3(109-140)Online publication date: 1-Nov-2020
https://doi.org/10.29252/jsdp.17.3.109
Show More Cited By

Recommendations

Privacy-aware role-based access control

In this article, we introduce a comprehensive framework supporting a privacy-aware access control mechanism, that is, a mechanism tailored to enforce access control to data containing personally identifiable information and, as such, privacy sensitive. ...
Privacy-Aware Role-Based Access Control

A privacy-aware role-based access control model extends RBAC to express highly complex privacy-related policies, including consideration of such features as conditions and obligations. Because it's based on the RBAC model, the full-fledged P-RBAC ...
Practical Role-Based Access Control

This article presents access control from a general and a role-based perspective. The article's focus is role based Access Control from a practical vice a theoretical perspective. The article starts with some access control definitions and two secure ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

SACMAT '07: Proceedings of the 12th ACM symposium on Access control models and technologies

June 2007

254 pages

ISBN:9781595937452

DOI:10.1145/1266840

General Chair:
Volkmar Lotz
SAP Labs, France
,
Program Chair:
Bhavani Thuraisingham
University of Texas at Dallas, USA

Copyright © 2007 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 20 June 2007

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Article

Conference

SACMAT07

Sponsor:

SACMAT07: 12th ACM Symposium on Access Control Models and Technologies

June 20 - 22, 2007

Sophia Antipolis, France

Acceptance Rates

Overall Acceptance Rate 177 of 597 submissions, 30%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

110
Total Citations
View Citations
1,608
Total Downloads

Downloads (Last 12 months)3
Downloads (Last 6 weeks)1

Reflects downloads up to 05 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Shrivastava SSrikanth T(2023)A Comprehensive Consent Management System for Electronic Health Records in the Healthcare EcosystemInformation Security and Privacy in Smart Devices10.4018/978-1-6684-5991-1.ch007(194-233)Online publication date: 31-Mar-2023
https://doi.org/10.4018/978-1-6684-5991-1.ch007
Shrivastava SSrikanth T(2021)A Dynamic Access Control Policy for Healthcare Service Delivery in Healthcare Ecosystem using Electronic Health Records2021 International Conference on COMmunication Systems & NETworkS (COMSNETS)10.1109/COMSNETS51098.2021.9352812(662-667)Online publication date: 5-Jan-2021
https://doi.org/10.1109/COMSNETS51098.2021.9352812
Ghofrani FAmini M(2020)Privacy Preserving Dynamic Access Control Model with Access Delegation for eHealthSignal and Data Processing10.29252/jsdp.17.3.10917:3(109-140)Online publication date: 1-Nov-2020
https://doi.org/10.29252/jsdp.17.3.109
Meng YHuang ZShen GKe C(2020)SDN-Based Security Enforcement Framework for Data Sharing Systems of Smart HealthcareIEEE Transactions on Network and Service Management10.1109/TNSM.2019.294121417:1(308-318)Online publication date: Mar-2020
https://doi.org/10.1109/TNSM.2019.2941214
Wang XFang ZWang DFeng AWang Q(2020)Research on Database Anomaly Access Detection Based on User Profile ConstructionFrontiers in Cyber Security10.1007/978-981-15-9739-8_30(388-399)Online publication date: 4-Nov-2020
https://doi.org/10.1007/978-981-15-9739-8_30
Wang HCao JZhang YWang HCao JZhang Y(2020)Building Access Control Policy Model for Privacy Preserving and Testing Policy Conflicting ProblemsAccess Control Management in Cloud Environments10.1007/978-3-030-31729-4_11(225-247)Online publication date: 30-Sep-2020
https://doi.org/10.1007/978-3-030-31729-4_11
Armando ABezzi MMetoui NSabetta A(2019)Risk-Based Privacy-Aware Information DisclosureCensorship, Surveillance, and Privacy10.4018/978-1-5225-7113-1.ch030(567-586)Online publication date: 2019
https://doi.org/10.4018/978-1-5225-7113-1.ch030
Capodieci AMainetti L(2019)Business process awareness to support GDPR complianceProceedings of the 9th International Conference on Information Systems and Technologies10.1145/3361570.3361573(1-6)Online publication date: 24-Mar-2019
https://dl.acm.org/doi/10.1145/3361570.3361573
Sicari SRizzardi AGrieco LPiro GCoen-Porisini A(2017)A policy enforcement framework for Internet of Things applications in the smart healthSmart Health10.1016/j.smhl.2017.06.0013-4(39-74)Online publication date: Sep-2017
https://doi.org/10.1016/j.smhl.2017.06.001
Ghazal RMalik AQadeer NAhmed M(2016)Intelligent Multi-Domain RBAC ModelInnovative Solutions for Access Control Management10.4018/978-1-5225-0448-1.ch003(66-95)Online publication date: 2016
https://doi.org/10.4018/978-1-5225-0448-1.ch003
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten