A comparison of two privacy policy languages: EPAL and XACML

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2006, Pages 53-60

  Anderson, Anne H ^a  

^a SUN MICROSYSTEMS   (United States)

Author keywords

EPAL; Policy language; Privacy policy; XACML

Indexed keywords

ACCESS DECISION; AUTOMATED ENFORCEMENT; ENTERPRISE PRIVACY AUTHORIZATION LANGUAGES; EXTENSIBLE ACCESS CONTROL MARKUP LANGUAGES; POLICY LANGUAGE; PRIVACY POLICIES; REGULATORY REQUIREMENTS;

ACCESS CONTROL; LINGUISTICS; MARKUP LANGUAGES; WEB SERVICES;

QUERY LANGUAGES;

EID: 77954321643     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1180367.1180378     Document Type: Conference Paper

References (31)

1. Agrawal, R., Kini, A., LeFevre, K., Wang, A., Xu, Y., and Zhou, D., Managing Healthcare Data Hippocratically, ACM SIGMOD 2004, June 13-18, 2004, Paris, France.
2. Anderson, A., Comparing Two Privacy Policy Languages: EPAL and XACML, Sun Microsystems Laboratories Technical Report 2005-147, 2005; http://research.sun. com/techrep/2005/smli-tr-2005-47/TRCompareEPALandXACML.html.
3. Anderson, A., ed., Core and hierarchical role based access control (RBAC) profile of XACML v2.0; OASIS Standard, February 1, 2005; http://docs.oasis- open.org/xacml/2.0/access-control-xacml-2.0-rbac-profile1-spec-os.pdf.
4. Anderson, A., ed., Hierarchical resource profile of XACML v2.0, OASIS Standard, 1 February 2005; http://docs.oasis-open.org/xacml/2.0/access-control- xacml-2.0-hier-profile-spec-os.pdf.
5. Anderson, A., and Lockhart, H., eds., SAML 2.0profile of XACML v2.0, OASIS Standard, 1 February 2005; http://docs.oasis-open.org/xacml/2.0/access- control-xacml-2.0-saml-profile-spec-os.pdf.
6. Anderson, A., ed., XACML References: Products and Deployments; http://docs.oasis-open.org/xacml/xacmlRefs.html#Products.
7. ANSI, Role Based Access Control; ANSI INCITS 359-2004.
8. Backes, M., Bagga, W., Karjoth, G., and Schunter, M., Efficient Comparison of Enterprise Privacy Policies,2004 ACM Symposium on Applied Computing, March 2004.
9. th IEEE International Workshop on Policies for Distributed Systems and Networks (POLICY'04), 2004.
10. Barth, A., and Mitchell, J. C., Enterprise privacy promises and enforcement, ACM WITS'05, January 10, 2005, Long Beach, CA, USA.
11. Barth, A., Mitchell, J. C., and Rosenstein, J., Conflict and Combination in Privacy Policy Languages (Summary), Workshop on Privacy in the Electronic Society, 28 October 2004.
12. Brodie, C., Karat, C-M., and Karat, J., An Empirical Study of Natural Language Parsing of Privacy Policy Rules Using the SPARCLE Policy Workbench, Proceedings of the second symposium on Usable privacy and security SOUPS '06, July 2006.
13. European Union, Directive on Data Privacy, 1998; http://europa.eu.int/ comm/justice-home/doc-centre/privacy/law/index-en.htm.
14. Hung, P. C. K., Ferrari, E., and Carminati, B., Towards Standardized Web Services Privacy Technologies, Proceedings of the IEEE International Conference on Web Services (ICWS'04), 2004.
15. IBM, Enterprise Privacy Authorization Language (EPAL), Version 1.2, 2003; http://www.w3.org/Submission/2003/SUBM-EPAL-20031110/.
16. ISO/IEC, 10181-3:1966 Information technology - Open Systems Interconnection - Security frameworks for open systems: Access control framework, 1966.
17. Mbanaso, U., Cooper, G., Chadwick, D., and Proctor, S., Privacy Preserving Trust Authorization Framework Using XACML, International Symposium on a World of Wireless, Mobile and Multimedia Networks, 2006 (WoWMoM 2006), 26-29 June 2006.
18. Moses, T., ed., eXtensible Access Control Markup Language (XACML), Version 2.0; OASIS Standard, February 1, 2005; http://www.oasis-open.org/ committees/tc-home.php?wg-abbrev=xacml.
19. Moses, T., ed., Privacy policy profile of XACML v2.0; OASIS Standard, February 1, 2005; http://docs.oasis-open.org/xacml/2.0/access-control-xacml-2.0- privacy-profile-spec-os.pdf.
20. Organization for Economic Co-operation and Development, Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, 23 September 1980; http://www.oecd.org/document/18/0,2340,en-2649-34255-1815186-1-1-1-1,00. html.
21. Peyton, L., and Nozin, M., Tracking Privacy Compliance in B2B Networks, ACM Sixth International Conference on Electronic Commerce (ICEC'04), 2004.
22. Schlager, C., A Reference Model for Authentication and Authorization Infrastructures Respecting Privacy and Flexibility in b2c eCommerce, The First International Conference on Availability, Reliability and Security (AARES 2006), 20-22 April 2006.
23. Stufflebeam, W., Anton, A., He, Q., and Jain, N., Specifying Privacy Policies with P3P and EPAL: Lessons Learned, Proceedings of the 2004 ACM Workshop on Privacy in the Electronic Society (WPES'04), October 2004.
24. Sun Microsystems, Inc., Sun's XACML Open Source Implementation; freely available under a BSD license at http://sunxacml.sourceforge.net/.
25. U.S. Government Department of Health and Human Services, Health Insurance Portability and Accountability Act (HIPAA), 1996; http://aspe.hhs.gov/admnsimp/ pl104191.htm.
26. U.S. Government Securities and Exchange Commission, Sarbanes-Oxley Act of 2002; http://www.sec.gov/about/laws/soa2002.pdf.
27. W3C, The Platform for Privacy Preferences 1.0 (P3P1.0) Specification, W3C Recommendation, 16 April 2002; http://www.w3.org/TR/P3P/.
28. W3C, XML Path Language (XPath) Version 1.0, W3C Recommendation, 16 November 1999; http://www.w3.org/TR/xpath.
29. W3C, XSL Transformations (XSLT) Version 1.0, W3C Recommendation, 16 November 1999; http://www.w3.org/TR/xslt.
30. Westerinen, A., Schnizlein, J., Strassner, J., et al., Terminology for Policy-Based Management, IETF RFC 3198, November 2001; http://www.ietf.org/rfc/ rfc3198.txt.
31. Yavatkar, R., Pendarakis, D., and Guerin, R., A Framework for Policy-based Admission Control, IETF RFC 2753, January 2000; http://www.ietf.org/rfc/rfc2753.txt.