论文信息 - Final requirements and state-of-the-art for next generation policies

Final requirements and state-of-the-art for next generation policies

One of the core activities in the PrimeLife project is the design and implementation of a versatile privacy policy language. Policy languages are a key element in any privacy-aware information infrastructure. Machineinterpretable languages have the major advantage over natural languages that, if designed properly, they allow automated negotiation, reasoning, composition, and enforcement of policies. This document provides the first step in the development of such a language. It describes a number of relevant use case scenarios involving privacy policies and derives from these a list of requirements that should be met by the PrimeLife policy language. It also presents a state of the art in policies languages.

Gregory Neven

[1] Ernesto Damiani,et al. Supporting location-based conditions in access control policies , 2006, ASIACCS '06.

[2] Gail-Joon Ahn,et al. Managing privacy preferences for federated identity management , 2005, DIM '05.

[3] Sabrina De Capitani di Vimercati,et al. Access Control: Policies, Models, and Mechanisms , 2000, FOSAD.

[4] Pierangela Samarati,et al. A Uniform Framework for Regulating Service Access and Information Release on the Web , 2002, J. Comput. Secur..

[5] Blair Dillaway,et al. Abductive Authorization Credential Gathering , 2009, 2009 IEEE International Symposium on Policies for Distributed Systems and Networks.

[6] Jan Camenisch,et al. An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation , 2001, IACR Cryptol. ePrint Arch..

[7] Ramakrishnan Srikant,et al. An XPath-based preference language for P3P , 2003, WWW '03.

[8] Springer-Verlag, 2001. , .

[9] Paul Ashley,et al. E-P3P privacy policies and privacy authorization , 2002, WPES '02.

[10] Andrew D. Gordon,et al. SecPAL: Design and semantics of a decentralized authorization language , 2010, J. Comput. Secur..

[11] Andrew D. Gordon,et al. Design and Semantics of a Decentralized Authorization Language , 2007, 20th IEEE Computer Security Foundations Symposium (CSF'07).