A toolkit for managing enterprise privacy policies

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 2808, Issue , 2003, Pages 162-180

  Backes, Michael ^a   Pfitzmann, Birgit ^a   Schunter, Matthias ^a  

^a IBM RESEARCH ZURICH   (Switzerland)

Author keywords

[No Author keywords available]

Indexed keywords

LAWS AND LEGISLATION;

COMPOSITION OPERATORS; CUSTOMER PREFERENCES; ENTERPRISE PRIVACY AUTHORIZATION LANGUAGES; INCOMPLETE DATA; LEGAL REGULATION; PRIVACY COMPLIANCE; PRIVACY ENFORCEMENT; PRIVACY POLICIES; SUPERSETS;

SEMANTICS;

EID: 0142157015     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-39650-5_10     Document Type: Conference Paper

References (22)

1. P. Ashley, S. Hada, G. Karjoth, C. Powers, and M. Schunter. Enterprise Privacy Authorization Language (EPAL). Research Report 3485, IBM Research, 2003. http://www.zurich.ibm.com/security/enterprise-privacy/epal/specification.
2. P. Ashley, S. Hada, G. Karjoth, and M. Schunter. E-P3P privacy policies and privacy authorization. In Proc. 1st ACM Workshop on Privacy in the Electronic Society (WPES), pages 103–109, 2002.
3. A. Belokosztolszki and K. Moody. Meta-policies for distributed role-based access control systems. In Proc. 3rd IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY), pages 106–115, 2002.
4. C. Bettini, S. Jajodia, X. S. Wang, and D. Wijesekerat. Obligation monitoring in policy management. In Proc. 3rd IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY), pages 2–12, 2002.
5. P. A. Bonatti, E. Damiani, S. De Capitani di Vimercati, and P. Samarati. A componentbased architecture for secure data publication. In Proc. 17th Annual Computer Security Applications Conference, pages 309–318, 2001.
6. P. A. Bonatti, S. De Capitani di Vimercati, and P. Samarati. A modular approach to composing access control policies. In Proc. 7th ACMConference on Computer and Communications Security, pages 164–173, 2000.
7. P. A. Bonatti, S. De Capitani di Vimercati, and P. Samarati. An algebra for composing access control policies. ACM Transactions on Information and System Security, 5(1):1–35, 2002.
8. A. Cavoukian and T. J. Hamilton. The Privacy Payoff: How successful businesses build customer trust. McGraw-Hill/Ryerson, 2002.
9. S. De Capitani di Vimercati and P. Samarati. An authorization model for federated systems. In Proc. 4th European Symposium on Research in Computer Security (ESORICS), volume 1146 of Lecture Notes in Computer Science, pages 99–117. Springer, 1996.
10. S. Fischer-Hübner. IT-security and privacy: Design and use of privacy-enhancing security mechanisms, volume 1958 of Lecture Notes in Computer Science. Springer, 2002.
11. Z. Fu, S. F. Wu, H. Huang, K. Loh, F. Gong, I. Baldine, and C. Xu. IPSec/VPN security policy: Correctness, conflict detection and resolution. In Proc. 2nd IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY), volume 1995 of Lecture Notes in Computer Science, pages 39–56. Springer, 2001.
12. V. Gligor, H. Khurana, R. Koleva, V. Bharadwaj and J. Baras. On the negotiation of access control policies. In Proc. 9th International Workshop on Security Protocols, 2002.
13. H. Hosmer. The multipolicy paradigm. In Proc. 15th National Computer Security Conference, pages 409–422, 1993.
14. S. Jajodia, M. Kudo, and V. S. Subrahmanian. Provisional authorization. In Proc. Ecommerce Security and Privacy, pages 133–159. Kluwer Academic Publishers, 2001.
15. S. Jajodia, P. Samarati, M. L. Sapino, and V. Subrahmanian. Flexible support for multiple access control policies. ACM Transactions on Database Systems, 26(4):216–260, 2001.
16. G. Karjoth and M. Schunter. A privacy policy model for enterprises. In Proc. 15th IEEE Computer Security Foundations Workshop (CSFW), pages 271–281, 2002.
17. G. Karjoth, M. Schunter, and M. Waidner. The platform for enterprise privacy practices – privacy-enabled management of customer data. In Proc. Privacy Enhancing Technologies Conference, volume 2482 of Lecture Notes in Computer Science, pages 69–84. Springer, 2002.
18. J. D. Moffett and M. S. Sloman. Policy hierarchies for distributed systems management. IEEE JSAC Special Issue on Network Management, 11(9):1404–31414, 1993.
19. Platform for Privacy Preferences (P3P).W3C Recommendation, Apr. 2002. http://www.w3.org/TR/2002/REC-P3P-20020416/.
20. C. Ribeiro, A. Zuquete, P. Ferreira, and P. Guedes. SPL: An access control language for security policies with complex constraints. In Proc. Network and Distributed System Security Symposium (NDSS), 2001.
21. TRUSTe. Privacy Certification. Available at www.truste.com.
22. eXtensible Access Control Markup Language (XACML). OASIS Committee Specification 1.0, Dec. 2002. www.oasis-open.org/committees/xacml.