A UML Profile for Privacy Enforcement

Izquierdo, Javier Luis Cánovas; Salas, Julián

doi:10.1007/978-3-030-04771-9_46

Cited by 4 publications

(1 citation statement)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this paper, our focus is on protecting user privacy during interactions with web-based services (e.g., online shopping transactions). Other related research focuses less on a complete architecture and more on specific components that could conceivably be used in such an architecture; recent examples include Kučera et al (2017), Canovas Izquierdo and Salas (2018), and Tripp and Rubin (2014), while previous work includes EPAL (APPEL, 2000;Ashley et al, 2002Ashley et al, , 2003, Hippocratic databases (Agrawal et al, 2002), and sticky policies (Beres et al, 2003). These individual component solutions are important, but do not address the need for an integrated overall architecture that enforces privacy in browser-server interactions.…”

Section: Related Workmentioning

confidence: 99%

Strengthening Enforcement in a Comprehensive Architecture for Privacy Enforcement at Internet Websites

Adams

DesOrmeaux

et al. 2020

Front. Comput. Sci.

View full text Add to dashboard Cite

This paper extends previous work to strengthen the enforcement portion of a comprehensive architecture for enforcing privacy when a user needs to submit personal data to an Internet website in order to obtain goods or services. Our extension proposes to use a website's P3P privacy policy (derived in an automated way from its internal XACML access control policy) as a public key to encrypt the user's data using IBE (identity-based encryption) technology. The website will only acquire the corresponding private key to decrypt this data if a trusted 3rd-party auditor (acting as an IBE private key generator) has verified that the P3P policy is an accurate statement of the site's internal privacy practices. We discuss all the components of this model and describe our proof-of-concept implementation which demonstrates that such an architecture is feasible in real-world scenarios.

show abstract