Requirements, design and evaluation of a privacy reference architecture for web applications and services

Proceedings of the ACM Symposium on Applied Computing

Volumn 13-17-April-2015, Issue , 2015, Pages 1425-1432

  Basso, Tania ^a   Moraes, Regina ^a   Jino, Mario ^a   Vieira, Marco ^b  

^a UNIVERSITY OF CAMPINAS   (Brazil)

^b UNIVERSITY OF COIMBRA   (Portugal)

Author keywords

Privacy; Reference architecture; Web application; Web service

Indexed keywords

DATA PRIVACY; QUALITY CONTROL; WEB SERVICES; WORLD WIDE WEB;

BUSINESS INFORMATION; DESIGN AND DEVELOPMENT; DESIGN AND EVALUATIONS; ORGANIZATIONAL INFORMATION SYSTEMS; PERSONAL INFORMATION; REFERENCE ARCHITECTURE; STANDARDIZATION MODELS; WEB APPLICATION;

INFORMATION MANAGEMENT;

EID: 84955491070     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2695664.2695774     Document Type: Conference Paper

References (29)

1. E. Bertino, D. Lin, and W. Jiang, "A Survey of Quantification of Privacy Preserving Data Mining Algorithms", in Privacy-Preserving Data Mining, vol. 34, C. C. Aggarwal, P. S. Yu, and A. K. Elmagarmid, Orgs. Springer US, pp. 183-205 (2008).
2. "Lawmakers Go After Carrier IQ Over Privacy Concerns". [Online]. Available: http://www.adweek.com/news/technology/lawmakers-goafter-carrier-iq-over-privacy-concerns-136880. [Accessed: 17-aug-2014].
3. "Austrian Law Student Faces Down Facebook". [Online]. Available: http://www.nytimes.com/2012/02/06/technology/06ihtrawdata06.html?pagewanted=all&-r=0. [Accessed: 17-aug-2014].
4. E. Y. Nakagawa, F. Oquendo, M. Becker. "RAModel: A Reference Model for Reference Architectures," Joint Working IEEE/IFIP Conference on Software Architecture (WICSA) and European Conference on Software Architecture (ECSA), 2012, pp.297-301, 20-24 (2012).
5. S. Angelov, P. Grefen. "An e-contracting reference architecture". J. Syst. Softw. 81, 11, pp. 1816-1844 (2008).
6. L. Bass, P. Clements, and R. Kazman, Software Architecture in Practice, Addison-Wesley Prof.,(2003).
7. ISO/IEC 29101. International Standard-Information technology-Security Techniques-Privacy architecture framework. First Edition (2013).
8. Y-N Shin, W. B. Chun, H. S. Jung, M. G. Chun. "Privacy Reference Architecture for Personal Information Life Cycle", in Advanced Communication and Networking, T. Kim, H. Adeli, R. J. Robles, e M. Balitanas, Orgs. Springer Berlin Heidelberg, pp. 76-85 (2011).
9. E.Y. Nakagawa, E.F. Barbosa, J.C. Maldonado. "Exploring ontologies to support the establishment of reference architectures: An example on software testing" in Joint Working IEEE/IFIP Conference on Software Architecture & European Conference on Software Architecture. WICSA/ECSA 2009, pp.249-252, (2009).
10. Authors removed for double-blind review. [Online]. Available: https://drive.google.com/folderview?id=0B9BaE1C-TUPfdlRkMndCdXprNjg&usp=drive-web. [Accessed: 25-sep-2014].
11. K. Reddy, H. S. Venter, M. Olivier, I. Currie. "Towards Privacy Taxonomy-Based Attack Tree Analysis for the Protection of Consumer Information Privacy," Sixth Annual Conference on Privacy, Security and Trust, 2008. PST '08., pp.56,64, 1-3 (2008).
12. A. I. Antón and J. B. Earp. A requirements taxonomy for reducing web site privacy vulnerabilities. Requirements Engineering, 9(3) pp.169-185 (2004).
13. D. Solove. "A Taxonomy of Privacy," University of Pennsylvania Law Review, Vol. 154, No. 3, pp. 477-560 (2006).
14. A.V. Padilha " Web Usability: A Proposal of a Questionnaire for Evaluation of the Satisfaction Degree of E-commerce Users". Work of master's degree in Computer Science. Federal University of Santa Catarina. Florianópolis, Brazil. (2004).
15. A. Bücker, B. Haase, D. Moore, M. Keller, O. Kobinger, H-F. Wu. "IBM Tivoli Privacy Manager. Solution Design and Best Practices". IBM Redbooks (2003).
16. M. C. Mont, R. Thyne, P. Bramhall. " Privacy Enforcement with HP Select Access for Regulatory Compliance". Hewlett-Packard Company (2005).
17. P. Bodorik, D. Jutla. "Privacy with Web Services: Intelligence Gathering and Enforcement". EEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology, 2008. WI-IAT '08. I, vol.3, pp.546,549, 9-12 (2008).
18. Authors removed for double-blind review. "A Database Framework for Expressing and Enforcing Personal Privacy Preferences". Submitted for publication. (2014).
19. "Web Browser Secure Settings" [Online]. Available: http://its.ucsc.edu/software/release/browser-secure.html [Accessed: 18-aug-2014].
20. "P3P: The Platform for Privacy Preferences". [Online]. Available: http://www.w3.org/P3P/. [Accessed: 04-aug-2014].
21. D. B. Giffin, A. Levy, D. Stefan, D. Terei, D. Mazières, J. C. Mitchell, and A. Russo. "Hails: protecting data privacy in untrusted web applications." In Proceedings of the 10th USENIX conference on Operating Systems Design and Implementation (OSDI'12), Berkeley, CA, USA, 47-60, 2012.
22. N. Antunes, M. Vieira. "Enhancing Penetration Testing with Attack Signatures and Interface Monitoring for the Detection of Injection Vulnerabilities in Web Services," IEEE International Conference on Services Computing (SCC), pp.104-111, (2011).
23. F. Roesner, T. Kohno, D. Wetherall. "Detecting and defending against third-party tracking on the web". In Proceedings of the 9th USENIX conference on Networked Systems Design and Implementation (NSDI'12). Berkeley, USA, (2012).
24. R. S. Sandhu, "Role-based Access Control", in Advances in Computers, vol. Volume 46, Elsevier, p. 237-286 (1998).
25. "OASIS eXtensible Access Control Markup Language (XACML) TC | OASIS". [Online]. Available: https://www.oasisopen.org/committees/tc-home.php?wg-abbrev=xacml. [Accessed: 07-aug-2014].
26. "How PGP Works". [Online]. Available: http://www.pgpi.org/doc/pgpintro/[Accessed: 02-aug-2014].
27. "Shibboleth". [Online]. Available: http://shibboleth.net/[Accessed: 01-aug-2014].
28. P. Samarati, L. Sweeney. "Generalizing data to provide anonymity when disclosing information". In Proceedings of the seventeenth ACM symposium on Principles of database systems (PODS '98). ACM, New York, NY, USA, pp. 188 (1998).
29. D. Biswas, V. Niemi. "Transforming Privacy Policies to Auditing Specifications," IEEE 13th International Symposium on High-Assurance Systems Engineering (HASE), 2011, pp.368-375, (2011).