Conflict and combination in privacy policy languages

Subscribe (Full Service)


	Search: The ACM Digital Library The Guide

	Feedback
Take a look at the new version of this page: [ beta version ]. Tell us what you think.

Conflict and combination in privacy policy languages

Full text

Pdf (76 KB)

Source

Workshop On Privacy In The Electronic Society archive
Proceedings of the 2004 ACM workshop on Privacy in the electronic society table of contents

Washington DC, USA

SESSION: Short papers table of contents

Pages: 45 - 46

Year of Publication: 2004

ISBN:1-58113-968-3

Authors

Adam Barth	Stanford University
John C. Mitchell	Stanford University
Justin Rosenstein	Stanford University and Google, Inc.

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control
ACM: Association for Computing Machinery

Publisher

ACM New York, NY, USA

Bibliometrics

Downloads (6 Weeks): 5, Downloads (12 Months): 82, Citation Count: 11

Additional Information:

abstract references cited by index terms collaborative colleagues

Tools and Actions:	Request Permissions Review this Article Save this Article to a Binder Display Formats: BibTeX EndNote ACM Ref

DOI Bookmark:	Use this link to bookmark this Article: http://doi.acm.org/10.1145/1029179.1029195 What is a DOI?

Warning: The download time has expired please click on the item to try again.

ABSTRACT

Many modern enterprises require methods for guaranteeing compliance with privacy legislation and announced privacy policies. IBM has proposed a formal language, the Enterprise Privacy Authorization Language (EPAL), for describing privacy policies rigorously. In this paper, we identify four desirable properties of a privacy policy language: guaranteed consistency, guaranteed safety, admitting local reasoning, and closure under combination. While EPAL achieves only one of these four goals, an extended language framework allows us to achieve three out of four, while retaining the basic EPAL framework of restricting access and imposing obligations on users of confidential information.

REFERENCES

Note: OCR errors may be found in this Reference List extracted from the full text article. ACM has opted to expose the complete List rather than only correct and linked references.

	1	Annie I. Anton , Qingfeng He , David L. Baumer, Inside JetBlue's Privacy Policy Violations, IEEE Security and Privacy, v.2 n.6, p.12-18, November 2004 [doi>10.1109/MSP.2004.103]
	2	Günter Karjoth , Matthias Schunter, A Privacy Policy Model for Enterprises, Proceedings of the 15th IEEE Computer Security Foundations Workshop (CSFW'02), p.271, June 24-26, 2002

CITED BY 11

	Adam Barth , John C. Mitchell, Enterprise privacy promises and enforcement, Proceedings of the 2005 workshop on Issues in the theory of security, p.58-66, January 10-11, 2005, Long Beach, California
	Radha Jagadeesan , Will Marrero , Corin Pitcher , Vijay Saraswat, Timed constraint programming: a declarative approach to usage control, Proceedings of the 7th ACM SIGPLAN international conference on Principles and practice of declarative programming, p.164-175, July 11-13, 2005, Lisbon, Portugal
	Anne H. Anderson, A comparison of two privacy policy languages: EPAL and XACML, Proceedings of the 3rd ACM workshop on Secure web services, November 03-03, 2006, Alexandria, Virginia, USA
	Qun Ni , Alberto Trombetta , Elisa Bertino , Jorge Lobo, Privacy-aware role based access control, Proceedings of the 12th ACM symposium on Access control models and technologies, June 20-22, 2007, Sophia Antipolis, France
	Xiangdong An , Dawn Jutla , Nick Cercone, Privacy intrusion detection using dynamic Bayesian networks, Proceedings of the 8th international conference on Electronic commerce: The new e-commerce: innovations for conquering current barriers, obstacles and limitations to conducting successful business on the internet, August 13-16, 2006, Fredericton, New Brunswick, Canada
	Xiangdong An , Dawn Jutla , Nick Cercone, A Bayesian Network Approach to Detecting Privacy Intrusion, Proceedings of the 2006 IEEE/WIC/ACM international conference on Web Intelligence and Intelligent Agent Technology, p.73-76, December 18-22, 2006
	Pietro Mazzoleni , Bruno Crispo , Swaminathan Sivasubramanian , Elisa Bertino, XACML Policy Integration Algorithms, ACM Transactions on Information and System Security (TISSEC), v.11 n.1, p.1-29, February 2008
	Paolo Guarda , Nicola Zannone, Towards the development of privacy-aware systems, Information and Software Technology, v.51 n.2, p.337-350, February, 2009
	Daniel J. Weitzner , Harold Abelson , Tim Berners-Lee , Joan Feigenbaum , James Hendler , Gerald Jay Sussman, Information accountability, Communications of the ACM, v.51 n.6, p.82-87, June 2008
	Timothy L. Hinrichs , Natasha S. Gude , Martin Casado , John C. Mitchell , Scott Shenker, Practical declarative network management, Proceedings of the 1st ACM workshop on Research on enterprise networking, August 21-21, 2009, Barcelona, Spain
	Anne Anderson, A comparison of two privacy policy languages: EPAL and XACML, Sun Microsystems, Inc., Mountain View, CA, 2005