Preserving privacy in web services

ABSTRACT

Web services are increasingly being adopted as a viable means to access Web-based applications. This has been enabled by the tremendous standardization effort to describe, advertise, discover, and invoke Web services. Digital government (DG) is a major application domain for Web services. It aims at improving government-citizen interactions using information and communication technologies. Government agencies collect, store, process, and share information about millions of citizens who have different preferences regarding their privacy. This naturally raises a number of legal and technical issues that must be addressed to preserve citizens' privacy through the control of the information flow amongst different entities (users, Web services, DBMSs). Solutions addressing this issue are still in their infancy. They consist, essentially, of enforcing privacy by law or by self-regulation. In this paper, we propose a new technical approach for preserving privacy in government Web services. Our design is based on digital privacy credentials, data filters and mobile privacy preserving agents. This work aims at establishing the feasibility and provable reliability of technology-based privacy preserving solutions for Web service infrastructures.

REFERENCES

• 1: A. Adams. User's Perception of Privacy in Multimedia Environment. PhD thesis, School of Psychology, University College London, 2001.
• 2: J. Algesheimer, C. Cachin, J. Camenisch, and G. Karjoth. Cryptographic security for mobile code. Technical Report RZ 3302 (# 93348), IBM Research, 2000.
• 3: Anonymizer. http://www.Anonymizer.com, 2002.
• 4: Andrew W. Appel, Foundational Proof-Carrying Code, Proceedings of the 16th Annual IEEE Symposium on Logic in Computer Science, p.247, June 16-19, 2001
• 5: Shimshon Berkovits , Joshua D. Guttman , Vipin Swarup, Authentication for Mobile Agents, Mobile Agents and Security, p.114-136, January 1998
• 6: Athman Bouguettaya , Ahmed K. Elmagarmid , Brahim Medjahed , M. Ouzzani, Ontology-based Support for Digital Government, Proceedings of the 27th International Conference on Very Large Data Bases, p.633-636, September 11-14, 2001
• 7: Athman Bouguettaya , Mourad Ouzzani , Brahim Medjahed , Jerry Cameron, Managing Government Databases, Computer, v.34 n.2, p.56-64, February 2001 [doi>10.1109/2.970578]
• 8: L. F. Cranor. Electronic Voting. ACM Crossroads Student Magazine, January 1996.
• 9: Sebastian Fischmeister , Giovanni Vigna , Richard A. Kemmerer, Evaluating the Security of Three Java-Based Mobile Agent Systems, Proceedings of the 5th International Conference on Mobile Agents, p.31-41, December 02-04, 2001
• 10: Eran Gabber , Phillip B. Gibbons , David M. Kristol , Yossi Matias , Alain Mayer, Consistent, yet anonymous, Web access with LPWA, Communications of the ACM, v.42 n.2, p.42-47, Feb. 1999 [doi>10.1145/293411.293447]
• 11: David Goldschlag , Michael Reed , Paul Syverson, Onion routing, Communications of the ACM, v.42 n.2, p.39-41, Feb. 1999 [doi>10.1145/293411.293443]
• 12: Fritz Hohl, Time Limited Blackbox Security: Protecting Mobile Agents From Malicious Hosts, Mobile Agents and Security, p.92-113, January 1998
• 13: HP. E-speak developer site. http://www.e-speak.net, 2002.
• 14: IBM. Aglet Software Development Kit. Online at: http://www.trl.ibm.com/aglets, 2000.
• 15: W. A. Jansen. Countermeasures for mobile agent security. Computer Communications: Spetial Issue on Advances in Research and Applications of Network Security, November 2000.
• 16: Günter Karjoth , Danny B. Lange , Mitsuru Oshima, A Security Model for Aglets, IEEE Internet Computing, v.1 n.4, p.68-77, July 1997 [doi>10.1109/4236.612220]
• 17: P. Lee and G. Necula. Research on proof-carrying code for mobile-code security. DARPA Workshop on Foundation for Secure Mobile Code, March 26-28 1997.
• 18: S. McCanne and V. Jacobson. The BSD packet filter: A new architecture for user-level packet capture. In USENIX Winter, pages 259--270, 1993.
• 19: B. Medjahed, M. Ouzzani, and A. Bouguettaya. Using web services in e-government applications. In Proc. of the National Conference on Digital Government Research, Los Angeles, CA, USA, May 19-22, 2002.
• 20: George C. Necula , Peter Lee, Safe, Untrusted Agents Using Proof-Carrying Code, Mobile Agents and Security, p.61-91, January 1998
• 21: A. Orso, G. Vigna, and M. Harrold. MASSA: Mobile Agents Security through Static/Dynamic Analysis. In Proc. the ICSE Workshop on Software Engineering and Mobility, Ontario, Canada, May 2001.
• 22: Michael K. Reiter , Aviel D. Rubin, Anonymous Web transactions with Crowds, Communications of the ACM, v.42 n.2, p.32-48, Feb. 1999 [doi>10.1145/293411.293778]
• 23: V. Roth. Mutual protection of co-operating agents. In Vitek and Jensen \citeSIP99, pages 277--287.
• 24: Tomas Sander , Christian F. Tschudin, Protecting Mobile Agents Against Malicious Hosts, Mobile Agents and Security, p.44-60, January 1998
• 25: H. K. Tan and L. Moreau. Mobile Code for Key Propagation. In K. Fischer and D. Hutter, editors, First International Workshop on Security of Mobile MultiAgent Systems (SEMAS'2001), Montreal, Canada, May 2001.
• 26: Shalom Tsur , Serge Abiteboul , Rakesh Agrawal , Umeshwar Dayal , Johannes Klein , Gerhard Weikum, Are Web Services the Next Revolution in e-Commerce? (Panel), Proceedings of the 27th International Conference on Very Large Data Bases, p.614-617, September 11-14, 2001
• 27: Jan Vitek , Christian D. Jensen, Secure Internet programming: security issues for mobile and distributed objects, Springer-Verlag, London, 2001
• 28: W3C. The Platform for Privacy Preferences 1.0 (P3P1.0) Specification, April 2002.
• 29: W3C. SOAP: Simple Object Access Protocol, http://www.w3.org/TR/soap, 2002.
• 30: W3C. UDDI: Universal Description, Discovery, and Integration, http://www.uddi.org, 2002.
• 31: W3C. WSDL: Web Services Description Language, http://www.w3.org/TR/wsdl, 2002.
• 32: Uwe G. Wilhelm , Sebastian Staamann , Levente Buttyán, Introducing trusted third parties to the mobile agent paradigm, Secure Internet programming: security issues for mobile and distributed objects, Springer-Verlag, London, 2001
• 33: B. Yee. A sancturary for mobile agents. In Vitek and Jensen {27}, pages 263--275.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.0 General

Additional Classification:
  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.5 On-line Information Services
          Subjects: Web-based services

General Terms:
Design, Management, Security

Keywords:
digital government, mobile agents, privacy, web services