Privacy and utility in business processes

Proceedings - IEEE Computer Security Foundations Symposium

Volumn , Issue , 2007, Pages 279-291

  Barth, Adam ^a   Mitchell, John C ^a   Datta, Anupam ^b   Sundaram, Sharada ^c  

^a STANFORD UNIVERSITY   (United States)

^b CARNEGIE MELLON UNIVERSITY   (United States)

^c TATA CONSULTANCY SERVICES   (India)

Author keywords

[No Author keywords available]

Indexed keywords

AUDIT LOGS; INEXACT INFORMATION; PRIVACY POLICY;

ABSTRACTING; ALGORITHMS; ELECTRONIC COMMERCE; MATHEMATICAL MODELS;

DATA PRIVACY;

EID: 35048898814     PISSN: 19401434     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CSF.2007.26     Document Type: Conference Paper

References (36)

1. http://www.epic.org/privacy/glba/.
2. N. R. Adam, V. Atluri, and W.-K. Huang. Modeling and analysis of workflows using petti nets. J. Intell. Inf. Syst., 10(2):131-158, 1998.
3. R. Alur, T. A. Henzinger, and O. Kupferman. Alternating-time temporal logic. J. ACM, 49(5):672-713, 2002.
4. A. Anderson. Key differences between XACML and EPAL. Ottawa new challenges for access control, 2005.
5. A. Anderson, A. Nadalin, B. Parducci, D. Engovatov, E. Coyne, F. Siebenlist, H. Lockhart, M. McIntosh, M. Kudo, P. Humenn, R. Jacobson, S. Proctor, S. Godik, S. Anderson, and T. Moses. Extensible access control markup language (XACML) version 2.0, 2004.
6. A. I. Antón, J. B. Earp, and A. Reese. Analyzing website privacy requirements using a privacy goal taxonomy. In Requirements Engineering 2002, pages 23-31, 2002.
7. A. I. Antón, Q. He, and D. L. Baumer. Inside JetBlue's privacy policy violations. IEEE Security and Privacy, 2(6): 12-18, 2004.
8. V. Atluri and W.-K. Huang. An authorization model for workflows. In European Symposium on Research in Computer Security (ESORICS), volume 1146 of LNCS, pages 44-64. Springer-Verlag, 1996.
9. M. Backes, B. Pfitzmann, and M. Schunter. A toolkit for managing enterprise privacy policies. In European Symposium on Research in Computer Security (ESORICS), volume 2808 of LNCS, pages 101-119. Springer-Verlag, 2003.
10. A. Barth, A. Datta, J. C. Mitchell, and H. Nissenbaum. Privacy and contextual integrity: Framework and applications. In IEEE Symposium on Security and Privacy, pages 184-198. IEEE Computer Society, 2006.
11. A. Barth and J. C. Mitchell. Enterprise privacy promises and enforcement. In Workshop on Issues in the Theory of Security, pages 58-66. ACM Press, 2005.
12. CNN. FBI seeks stolen personal data on 26 million vets. www.cnn.com/2006/US/05/22/vets.data/.
13. L. F. Cranor. Web Privacy with P3P. O'Reilly and Associates, Inc., 2002.
14. CSO Online. Safety in numbers. http://www.csoonline.com/metrics/ viewmetric.cfm?id=265.
15. M. Dumas and A. H. M. ter Hofstede. UML activity diagrams as a workflow specification language. In UML 2001, pages 76-90. Springer-Verlag, 2001.
16. C. Dwork and K. Nissim. Privacy-preserving datamining on vertically partitioned databases. In CRYPTO 2004: 24th Annual International Cryptology Conference, volume 3152 of LNCS, pages 528-544. Springer-Verlag, 2004.
17. C. Evans-Pughe. The logic of privacy. The Economist, 382(8510):65-66, 2007.
18. Federal Trade Commission. In brief: the financial privacy requirements of the Gramm-Leach-Bliley Act. http://www.ftc.gov/bcp/conline/pubs/buspubs/ glbshort.htm, 2002.
19. G. Karjoth and M. Schunter. A privacy policy model for enterprises. In IEEE Computer Security Foundations Work-shop, page 271. IEEE Computer Society, 2002.
20. L. Lamport. Time, clocks, and the ordering of events in a distributed system. Commun. ACM, 21(7):558-565, 1978.
21. K. LeFevre, R. Agrawal, V Ercegovac, R. Ramakrishnan, Y Xu, and D. DeWitt. Limiting disclosure in hippocratic databases. In 30th Int'l Conf. on Very Large Data Bases, August 2004., Toronto, Canada, 2004.
22. D. Lewis. Causation as influence. The Journal of Philosophy, 97(4): 181-197, 2000.
23. Z. Manna and A. Pnueli. Temporal Verification of Reactive Systems: Safety. Springer-Verlag, 1995.
24. Markle Foundation. The Connecting for Health Common Framework, http://www.connectingforhealth.org/commonframework/, 2006.
25. M. J. May, C. A. Gunter, and I. Lee. Privacy apis: Access control techniques to analyze and verify legal privacy policies. In IEEE Workshop on Computer Security Foundations, pages 85-97. IEEE Computer Society, 2006.
26. H. Nissenbaum. Privacy as contextual integrity. Washington Law Review, 79(1):119-158, 2004.
27. OASIS. OASIS Web Services Process Execution Language (WSBPEL). http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wsbpel.
28. Office for Civil Rights. Summary of the HIPAA privacy rule. US Department of Health & Human Services, 2003.
29. Oracle. Oracle BPEL Process Manager. http ://www.oracle.com/technology/ products/ias/bpel/.
30. J. Reagle and L. F. Cranor. The platform for privacy preferences. Communications of the ACM, 42(2):48-55, 1999.
31. P. Samarati. Protecting respondent's privacy in microdata release. IEEE Transactions on Knowledge and Data Engineering, 13(6): 1010-1027, 2001.
32. M. Schunter, P. Ashley, S. Hada, G. Karjoth, C. Powers, and M. Schunter. Enterprise privacy authorization language (EPAL 1.1). http://www.zurich.ibm.com/ security/enterprise-privacy/epal/Specification/, 2003.
33. L. Sweeney. k-Anonymity: A model for protecting privacy. International Journal on Uncertainty, Fuzziness and Knowledge-based Systems, 10(5):557-570, 2002.
34. W. Teepe, R. P. van de Riet, and M. S. Olivier. Workflow analyzed for security and privacy in using databases. In Working Conference on Database Security, pages 271-282. Kluwer, B.V, 2001.
35. University of Medicine & Dentistry of New Jersey. HIPAA Security Standards FAQ's.http://www2.umdnj.edu/hipaaweb/security/security.emailFAQ02.htm.
36. Vanderbilt Medical Center. MyHealthAtVanderbilt. https://www. myhealthatvanderbilt.com/.