A Framework for Expressing and Enforcing Purpose-Based Privacy Policies
| dc.contributor.author | Jafari, Mohammad | en_US |
| dc.contributor.author | Fong, Philip | en_US |
| dc.contributor.author | Safavi-Naini, Reihaneh | en_US |
| dc.contributor.author | Barker, Ken | en_US |
| dc.date.accessioned | 2013-01-28T17:34:14Z | |
| dc.date.available | 2013-01-28T17:34:14Z | |
| dc.date.issued | 2013-01-28 | |
| dc.description.abstract | Purpose is a key concept in privacy policies and has been mentioned in major privacy laws and regulations. Although some models have been proposed for enforcing purpose-based policies, little has been done in de ning formal semantics for purpose and therefore an e ective enforcement mechanism for policies has remained a challenge. In this paper, we develop a framework for formalizing and enforcing purpose-based privacy policies. Purpose is formally de ned as the dynamic situation of an action within the network of inter-related actions in the system. Accordingly, we propose a modal-logic language for formally expressing constraints about purposes of actions which can be used to model purpose-based policies. The semantics of this language are de ned over an abstract model of activities in the system which is directly derivable from business processes. Based on this formal framework, we discuss some properties of purpose and show how some well-known, as well as new forms of purpose constraints can be formalized using the proposed language. We also show how purpose-based constraints can be tied to other access control policies in the system. Finally, we present a model-checking algorithm for verifying whether a given state of the system complies with a given set of policies, followed by a discussion of how this can be used in an actual implementation of a purpose reference monitor. | en_US |
| dc.description.refereed | No | en_US |
| dc.identifier.department | 2013-1037-04 | en_US |
| dc.identifier.doi | http://dx.doi.org/10.11575/PRISM/30597 | |
| dc.identifier.uri | http://hdl.handle.net/1880/49351 | |
| dc.language.iso | eng | en_US |
| dc.publisher.corporate | University of Calgary | en_US |
| dc.publisher.faculty | Science | en_US |
| dc.subject | Purpose | en_US |
| dc.subject | Semantics | en_US |
| dc.subject | purpose-Based policies | en_US |
| dc.subject.other | Privacy, Modal Logic, Workflow, Petri Net | en_US |
| dc.title | A Framework for Expressing and Enforcing Purpose-Based Privacy Policies | en_US |
| dc.type | technical report | en_US |
| thesis.degree.discipline | Computer Science | en_US |