Browse > Article
http://dx.doi.org/10.13089/JKIISC.2006.16.6.47

A Policy-based Privacy Authorization System in the Internet Environment  

Choi, Hyang-Chang (Chonnam University)
Park, Hee-Man (Chonnam University)
Lee, Seung-Yong (Chonnam University)
Noh, Bong-Nam (Chonnam University)
Lee, Hyung-Hyo (Wonkwang University)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.16, no.6, 2006 , pp. 47-61 More about this Journal
Abstract
In the Internet era, enterprises want to use personal information of their own or other enterprises' subscribers, and even provide it to other enterprises for their profit. In this paper, a privacy authorization system for personal information based on privacy policies of users and enterprises is designed and implemented. Privacy policies of users and enterprises are described in XACML. Also, components of policy in XACML 2.0 such as Purpose, Obligation are suitable for expressing privacy policy. A prototype of privacy authorization system is implemented by modifying and extending the SUNXACML 1.2, a Sun's implementation of XACML 1.0 and some features of XACML 2.0, and GUI tools for composing and verifying are also developed.
Keywords
Privacy Protection; Access Control; Authorization System;
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 Abdelmounaam Rezgui, Athman Bouguettaya, Mohamed Y. Eltowe issy, Virginia Tech, 'Privacy on the Web: Facts, Challenges, and Solu tions,' IEEE Security and Privacy (Vol. 1, No. 6), 2003
2 Computer Science and Telecommuni cations Board (CSTB), 'Who Goes There?: Authentication Through the Lens of Privacy,' The National Academies, 2003. http://www.nap. ed u/catalog/10656.html
3 OASIS, 'eXtensible Access Control Markup Language (XACML) Version 2.0,' OASIS Committee Specification (T. Moses,editor), 2005
4 Paul Ashley, Satoshi Hada, Gunter Karjoth, Calvin Powers, Matthias Schunter 'Enterprise Privacy Authorization Language (EPAL 1.2),' W3C, 2003, http://www.w3. org /Submission/2003/SUBM-EPAL- 20031110
5 Lorrie Faith Cranor, 'Web Privacy with P3P,' AT&T, 2002
6 'P3P 1.0: The Platform for Privacy Preferences 1.0 Specification,' W3C, 2002, http://www.w3.org/TR/P3P/
7 P. Ashley, S. Hada, G. Karjoth, M. Schunter, 'E-P3P: Privacy Policies and Privacy Authorization,' WPES, November 2002
8 최향창, 이용훈, 노봉남, 이형효, 조상래, 진 승헌,' ID관리시스템에서의 프라이버시 보호,' 한국정보보호학회지 1598-3978 제14권6호, pp.82-93, 2004
9 Lorrie Faith Cranor, 'Web Privacy with P3P,' AT&T, 2002
10 G. Karjoth, M. Schunter, E. Van Herreweghen, and M. Waidner, 'Amending P3P for Clearer Privacy Promises,' 14th International Workshop on Database and Expert Sys tems Applications, 2003
11 Magnuson, G., Reid, P. 'Privacy and Identity Management Survey,' IAPP Conference, 2004
12 Samuel D. Warren, Louis D. Brandeis, 'The Right to Privacy,' Harvard Law Review, 1980
13 Hyang-Chang Choi, Seung-Yong Lee, Hyung-Hyo Lee, 'PIMS: An Access-Control based Privacy Model for Identity Management Systems,' GESTS International Transaction on Computer Science and Engineering, Vol.9 and No.1(ISSN 1738-6438), 2005
14 Sun, 'Sun's XACML Implementa tion,' January 7, 2005. http:// sunxac ml.sourceforge.net/
15 'PRIME: Privacy and Identity Management for Europe Date of preparation,' PRIME Project, 2004, http://www.prime-project. eu.org/
16 OASIS, 'eXtensible Access Control Markup Language (XACML) Version 1.0,' OASIS Committee Specification (T. Simon Godik, editor), 2003
17 최향창, 이형효, 노종혁, 진승헌 '정책 기반 프라이버시 보호시스템 설계 및 구현,' 한국정보과학회 정보보호 연구회지, 2005
18 'OECD: Guidelines on the Prote ction of Privacy and Transborder Flows of Personal Data,' Orga nisation for Economic Co-Operation and Development, 1981
19 'RAPID: Roadmap for Advanced Research in Privacy and Identity Management,' RAPID Project, 2001, http://www.ra-pid.org
20 Christine Varney, Hogan & Hartson, 'Privacy and Security Best Prac tices,' Liberty Alliance Project, November 12, 2003
21 Anne Anderson, Sun Microsystems, 'XACML Profile for Role Based Access Control (RBAC),' OASIS, February 2004
22 M. Mealing, R. Denenberg, Uniform Resource Identifiers(URIs), URLs, and Uniform Resource Names(URN s): Clarifications and Recommen dations, http://www. ietf.org/rfc/rfc33 05.txt, RFC 3305, August 2002