Data Governance and Transparency for Collaborative Systems

As social networks, shared editing platforms and other collaborative systems are becoming increasingly popular, the demands for proper protection of the data created and used within these systems grows. Yet, existing access control mechanisms are not suited for the challenges imposed by collaborative systems. Two main challenges should be addressed: collaborative specification of permissions, while ensuring an appropriate levels of control to the different parties involved, and enabling transparency in decision making in cases where the access requirements of these different parties are in conflict. In this paper we propose a data governance model for collaborative systems, which allows the integration of access requirements specified by different users based on their relation with a data object. We also study the practical feasibility of enabling transparency by comparing different deployment options for transparency in XACML.

[1]  Jenny de Fine Licht.  Transparency actually: how transparency affects public perceptions of political decision-making , 2014 .

[2]  Roshan K. Thomas,et al.  Team-based access control (TMAC): a primitive for applying role-based access controls in collaborative environments , 1997, RBAC '97.

[3]  Jorge Lobo,et al.  Access control policy combining: theory meets practice , 2009, SACMAT '09.

[4]  Nicola Zannone,et al.  Privacy Implications of Privacy Settings and Tagging in Facebook , 2013, Secure Data Management.

[5]  Jerry den Hartog,et al.  CollAC: Collaborative access control , 2014, 2014 International Conference on Collaboration Technologies and Systems (CTS).

[6]  Ravi S. Sandhu,et al.  Role-Based Access Control Models , 1996, Computer.

[7]  Seng-Phil Hong,et al.  Access control in collaborative systems , 2005, CSUR.

[8]  Andreas Matheus,et al.  How to Declare Access Control Policies for XML Structured Information Objects using OASIS' eXtensible Access Control Markup Language (XACML) , 2005, Proceedings of the 38th Annual Hawaii International Conference on System Sciences.

[9]  Nicola Zannone,et al.  Towards the development of privacy-aware systems , 2009, Inf. Softw. Technol..

[10]  Jerry den Hartog,et al.  SAFAX – An Extensible Authorization Service for Cloud Environments , 2015, Front. ICT.

[11]  Gail-Joon Ahn,et al.  Multiparty Access Control for Online Social Networks: Model and Mechanisms , 2013, IEEE Transactions on Knowledge and Data Engineering.

[12]  Anna Cinzia Squicciarini,et al.  WWW 2009 MADRID! Track: Security and Privacy / Session: Web Privacy Collective Privacy Management in Social Networks , 2022 .

[13]  Lujo Bauer,et al.  Effects of access-control policy conflict-resolution methods on policy-authoring usability , 2009 .

[14]  Ponnurangam Kumaraguru,et al.  Cue: a framework for generating meaningful feedback in XACML , 2010, SafeConfig '10.

[15]  Ilaria Matteucci,et al.  Prioritized Execution of Privacy Policies , 2012, DPM/SETOP.

[16]  Sushil Jajodia,et al.  Flexible support for multiple access control policies , 2001, TODS.

[17]  Ravi S. Sandhu,et al.  Task-Based Authorization Controls (TBAC): A Family of Models for Active and Enterprise-Oriented Autorization Management , 1997, DBSec.

[18]  Urs-Vito Albrecht,et al.  Transparency of Health-Apps for Trust and Decision Making , 2013, Journal of medical Internet research.

[19]  Anant Joshi,et al.  An Empirical Assessment of IT Governance Transparency: Evidence from Commercial Banking , 2013, Inf. Syst. Manag..

[20]  Elisa Bertino,et al.  XACML Policy Integration Algorithms , 2008, TSEC.

[21]  Prasun Dewan,et al.  Access control for collaborative environments , 1992, CSCW '92.