Proposed NIST standard for role-based access control
ACM Transactions on Information and System Security (TISSEC)
Towards usage control models: beyond traditional access control
SACMAT '02 Proceedings of the seventh ACM symposium on Access control models and technologies
The UCONABC usage control model
ACM Transactions on Information and System Security (TISSEC)
Purpose based access control of complex data for privacy protection
Proceedings of the tenth ACM symposium on Access control models and technologies
Formal model and policy specification of usage control
ACM Transactions on Information and System Security (TISSEC)
A general obligation model and continuity: enhanced policy enforcement engine for usage control
Proceedings of the 13th ACM symposium on Access control models and technologies
Usage Control Enforcement: Present and Future
IEEE Security and Privacy
Enforcing purpose of use via workflows
Proceedings of the 8th ACM workshop on Privacy in the electronic society
Privacy-aware role-based access control
ACM Transactions on Information and System Security (TISSEC)
Towards defining semantic foundations for purpose-based privacy policies
Proceedings of the first ACM conference on Data and application security and privacy
Formalizing and Enforcing Purpose Restrictions in Privacy Policies
SP '12 Proceedings of the 2012 IEEE Symposium on Security and Privacy
Towards purpose enforcement model for privacy-aware usage control policy in distributed healthcare
International Journal of Security and Networks
| Hi-index | 0.00 |
Privacy-aware usage control is a control of the usage of private data with the aim to protect data owner privacy. In privacy-aware system, the purpose of data usage is strictly controlled to ensure that data owner privacy is properly protected and data would never be used beyond what it is authorized for. To fulfill that level of protection, it requires the strong enforcement of usage policy, in particular, the enforcement of the purpose of data usage. However, there are many difficulties in purpose enforcement. One of which is to validate the purpose of an agent when it requests to perform an action, particularly in distributed environments where the processing of data is carried out on client side application and direct control of it is limited. Generally, validating "a particular purpose" may require different mechanisms and can happen at different points in time during the lifecycle of data usage. Hence, there is a need to express "how purpose should be validated" by indicating which validation mechanisms should be used and when the validation should take place so that the remote system can act as instructed. In this paper, we discuss the design issue of purpose validation policy expression based on our proposed validation structure: pre-, ongoing-, and post-validation. Furthermore, we discuss how the existing languages such as EPAL, XACML, and ODRL can directly be used or extended to support our proposed purpose validation policy model.