Article

SQL's revoke with a view on privacy

Authors:

Wynand JC van Staden,

Martin S OlivierAuthors Info & Claims

SAICSIT '07: Proceedings of the 2007 annual research conference of the South African institute of computer scientists and information technologists on IT research in developing countries

Pages 181 - 188

https://doi.org/10.1145/1292491.1292512

Published: 02 October 2007 Publication History

Abstract

Protecting access to data that can be linked to an individual (or personal identifiable information (PII)), thereby seeking to protect the individual's privacy can be accomplished through legislation, organisational safeguards, and technology. Of particular interest and the focus of this paper is the technological means by which data is protected, in particular we are considering the mechanisms of purpose binding and limitation which facilitate the organisational safeguards. Purpose binding allows an enterprise to specify their purpose with collected data, and purpose limitation controls access to information based on these purpose bindings.

Technologies that implement the aforementioned safeguards of PII forms a subset of a set of technologies commonly referred to as Privacy Enhancing Technologies (PETs). Many legacy systems do not employ these safeguards, even though it can be accomplished by providing "wrapper" technologies which reside on top of these legacy systems.

This article continues work done by the authors in which extensions to SQL was proposed in order to integrate PETs with structured databases. The extensions showed that access to data through SQL can be controlled non-intrusively, and that the general discretionary access control model provided by many database management systems can still be enforced. In our previous work the extensions were limited to the SQL grant and select statements.

In this article we propose a model for revoking privileges from database users, and thus consider the SQL revoke statement. We also show that the general principles of revoking privileges remain true for our proposed model. We also briefly consider extensions to the commands from the Data Manipulation Language (DML) that was not considered, being insert, delete, and update.

References

[1]

R. Agrawal, J. Kiernan, R. Srikant, and Y. Xu. Hippocratic databases. In Proceedings of the 28th VLDB Conference, Hong Kong, China, 2002.

Digital Library

[2]

P. Ashley, S. Hada, G. Karjoth, C. Powers, and M. Schunter. Enterprise privacy authorisation language (EPAL 1.1). Technical report, International Business Machines Corporation, 2003.

[3]

J.-W. Byun, E. Bertino, and N. Li. Purpose based access control of complex data for privacy protection. In SACMAT'05, Stockholm, Sweden, June 2005. ACM.

Digital Library

[4]

D. L. Chaum. Untraceable electronic mail, retrun addresses and digital pseudonyms. Communications of the ACM, 24(2):84--88, 1981.

Digital Library

[5]

G. Danezis, R. Dingledine, and N. Mathewson. Mixminion: Design of a Type III Anonymous Remailer Protocol. In Proceedings of the 2003 IEEE Symposium on Security and Privacy, May 2003.

Digital Library

[6]

C. J. Date. An introduction to database systems, volume 1. Addison-Wesley, seventh edition, 2002.

Digital Library

[7]

R. Dingledine, N. Mathewson, and P. Syverson. Tor: The second-generation onion router. In Proceedings of the 13th USENIX Security Symposium, August 2004.

Digital Library

[8]

S. Fischer-Hübner. IT-Security and Privacy: Design and Use of Privacy-Enhancing Security Mechanisms. Springer-Verlag, 2001.

Digital Library

[9]

R. Hes and J. Borking, editors. Privacy Enhancing Technologies: The Road to Anonimity. Dutch DPA, revised edition, 1998.

[10]

G. Karjoth and M. Schunter. A privacy policy model for enterprises. In Proceedings of the 15th IEEE Computer Security Foundations Workshop. Springer-Verlag, June 2002.

Digital Library

[11]

OASIS Access Control TC. OASIS extensible access control markup language (xacml) version 2.0. Technical report, OASIS, February 2005.

[12]

H. J. Oberholzer and M. S. Olvier. Privacy contracts incorporated in a privacy protection framework. International Journal of Computer Systems Science and Engineering, 21(1):5--16, 2006.

[13]

OECD guidelines on the protection of privacy and transborder flows of personal data. Technical report, Organisation for Economic Co-operation and Development, 1980.

[14]

M. S. Olivier. Flocks: Distributed proxies for browsing privacy. In G. Marsden, P. Kotzé, and A. Adesina-Ojo, editors, Proceedings of SAICSIT 2004 -- fulfilling the promise of ICT, pages 79--88, Stellenbosch, South Africa, October 2004.

Digital Library

[15]

A. Pfitzmann and M. Hansen. Anonymity, unobservability, and pseudonymity: A consolidated proposal for terminology. Electronically Published, July 2007.

[16]

M. Schunter and P. Ashley. The platform for enterprise privacy practices. Technical report, IBM, 2002.

[17]

W. J. van Staden and M. S. Olivier. Purpose organisation. In Proceedings of the fifth annual Information Security South Africa (ISSA) Conference, Sandton, Johannesburg, South Africa, June 2005.

[18]

W. J. van Staden and M. S. Olivier. Extending SQL to allow active secification of purposes. In Third International Conference on Trust and Privacy for Digital Bussines, Krakow, Poland, 2006. Springer-Verlag.

Digital Library

[19]

W. J. van Staden and M. S. Olivier. Using purpose lattices to facilitate the customisation of privacy agreements. In Accepted for publication in the proceedings of the Fourth International Conference on Trust and Privacy for Digital Business, Regensburg, Germany, September 2007. Springer-Verlag.

Digital Library

Cited By

Ghazinour KPun SMajedi MChinaci ABarker K(2010)Extending SQL to Support Privacy PoliciesFrom Sociology to Computing in Social Networks10.1007/978-3-7091-0294-7_20(377-393)Online publication date: 2010
https://doi.org/10.1007/978-3-7091-0294-7_20
Pun SChinaei ABarker K(2009)Twins (1)Proceedings of the 2009 International Conference on Advances in Social Network Analysis and Mining10.1109/ASONAM.2009.76(306-311)Online publication date: 20-Jul-2009
https://dl.acm.org/doi/10.1109/ASONAM.2009.76
Majedi MGhazinour KChinaei ABarker K(2009)SQL Privacy Model for Social NetworksProceedings of the 2009 International Conference on Advances in Social Network Analysis and Mining10.1109/ASONAM.2009.60(369-370)Online publication date: 20-Jul-2009
https://dl.acm.org/doi/10.1109/ASONAM.2009.60

Index Terms

SQL's revoke with a view on privacy

Recommendations

An authorization mechanism for a relational database system

A multiuser database system must selectively permit users to share data, while retaining the ability to restrict data access. There must be a mechanism to provide protection and security, permitting information to be accessed only by properly authorized ...
Privacy-enhanced access control in primelife
DIM '10: Proceedings of the 6th ACM workshop on Digital identity management

This talk gives an overview of the PrimeLife¹ project, funded by the European Commission's 7th Framework Programme, with a particular focus on its research results in privacy-preserving access control in distributed systems. Users commonly reveal more ...
A card requirements language enabling privacy-preserving access control
SACMAT '10: Proceedings of the 15th ACM symposium on Access control models and technologies

We address the problem of privacy-preserving access control in distributed systems. Users commonly reveal more personal data than strictly necessary to be granted access to online resources, even though existing technologies, such as anonymous ...

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences

SAICSIT '07: Proceedings of the 2007 annual research conference of the South African institute of computer scientists and information technologists on IT research in developing countries

October 2007

211 pages

ISBN:9781595937759

DOI:10.1145/1292491

Program Chairs:
Lynette Barnard
Nelson Mandela Metropolitan University, South Africa
,
Reinhardt A Botha
Nelson Mandela Metropolitan University, South Africa

Copyright © 2007 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Telcom
Microsoft: Microsoft
COE

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 02 October 2007

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Article

Conference

SAICSIT '07

Sponsor:

Microsoft

SAICSIT '07: 2007 Annual Conference of the South African Institute of Computer Scientists and Information Technologists

October 2 - 3, 2007

Port Elizabeth, South Africa

Acceptance Rates

Overall Acceptance Rate 187 of 439 submissions, 43%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

3
Total Citations
View Citations
224
Total Downloads

Downloads (Last 12 months)0
Downloads (Last 6 weeks)0

Reflects downloads up to 07 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Ghazinour KPun SMajedi MChinaci ABarker K(2010)Extending SQL to Support Privacy PoliciesFrom Sociology to Computing in Social Networks10.1007/978-3-7091-0294-7_20(377-393)Online publication date: 2010
https://doi.org/10.1007/978-3-7091-0294-7_20
Pun SChinaei ABarker K(2009)Twins (1)Proceedings of the 2009 International Conference on Advances in Social Network Analysis and Mining10.1109/ASONAM.2009.76(306-311)Online publication date: 20-Jul-2009
https://dl.acm.org/doi/10.1109/ASONAM.2009.76
Majedi MGhazinour KChinaei ABarker K(2009)SQL Privacy Model for Social NetworksProceedings of the 2009 International Conference on Advances in Social Network Analysis and Mining10.1109/ASONAM.2009.60(369-370)Online publication date: 20-Jul-2009
https://dl.acm.org/doi/10.1109/ASONAM.2009.60

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten