Modelling and Enforcing Purpose in Privacy Policies

Simple item page
atmire.migration.oldid1286
dc.contributor.advisorSafavi-Naini, Reyhaneh Alsadat
dc.contributor.advisorBarker, Kenneth Edwin
dc.contributor.authorJafari, Mohammad
dc.date.accessioned2013-09-06T16:16:03Z
dc.date.available2013-11-12T08:00:12Z
dc.date.issued2013-09-06
dc.date.submitted2013en
dc.description.abstractPrivacy concerns are among the most significant side effects of advances in computer and networking technologies. Expressing and enforcing privacy policies is necessary to ensure that processing of personal information in these systems does not violate privacy of individuals. Privacy laws and regulations, as well as various privacy policy languages and privacy-preserving systems show no disagreement in that purpose of use has a key role in privacy policies and is an important factor in controlling access to personal data. In the current literature on privacy, purposes have been treated mostly as opaque labels with little or no semantics. The resulting ambiguities have made purposes susceptible to malicious or inadvertent misinterpretations. Consequently, enforcing purpose-based policies has also remained a challenge. In this research, we address these problems. We develop a framework that defines purposes formally and provides a formal language for expressing purpose constraints, as well as the corresponding method for evaluating them in the context of a workflow. The semantics of this language are defined over an abstract model of business workflows. We show how purpose constraints can be linked to access control rules to form purpose-based policies and develop an enforcement mechanism in the form of a workflow reference monitor to ensure compliance to such policies. We also show how a simple form of such a reference monitor can be implemented using XACML, a common open standard access control system in the industry.en_US
dc.identifier.citationJafari, M. (2013). Modelling and Enforcing Purpose in Privacy Policies (Doctoral thesis, University of Calgary, Calgary, Canada). Retrieved from https://prism.ucalgary.ca. doi:10.11575/PRISM/26953en_US
dc.identifier.doihttp://dx.doi.org/10.11575/PRISM/26953
dc.identifier.urihttp://hdl.handle.net/11023/924
dc.language.isoeng
dc.publisher.facultyGraduate Studies
dc.publisher.institutionUniversity of Calgaryen
dc.publisher.placeCalgaryen
dc.rightsUniversity of Calgary graduate students retain copyright ownership and moral rights for their thesis. You may use this material in any way that is permitted by the Copyright Act or through licensing that has been assigned to the document. For uses that are not allowable under copyright legislation or licensing, you are required to seek permission.
dc.subjectComputer Science
dc.subject.classificationPurposeen_US
dc.subject.classificationPrivacyen_US
dc.subject.classificationWorkflowen_US
dc.titleModelling and Enforcing Purpose in Privacy Policies
dc.typedoctoral thesis
thesis.degree.disciplineComputer Science
thesis.degree.grantorUniversity of Calgary
thesis.degree.nameDoctor of Philosophy (PhD)
ucalgary.item.requestcopytrue
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
ucalgary_2013_jafari_mohammad.pdf
Size:
1.17 MB
Format:
Adobe Portable Document Format
Description:
Download
License bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
license.txt
Size:
2.65 KB
Format:
Item-specific license agreed upon to submission
Description:
Download
Collections
Open Theses and Dissertations