A uniform framework for regulating service access and information release on the Web

Issue title: CCS 2000

Article type: Research Article

Authors: Bonatti, Piero A. | Samarati, Pierangela^{; *}

Affiliations: Dipartimento di Tecnologie dell'Informazione, Università di Milano, Via Bramante, 65, I-26013 Crema, Italy. E-mail: [email protected], [email protected]

Correspondence: [*] Corresponding author. Tel.: +39 0373 898061; Fax: +39 0373 898010.

Abstract: The widespread use of Internet-based services is increasing the amount of information (such as user profiles) that clients are required to disclose. This information demand is necessary for regulating access to services, and functionally convenient (e.g., to support service customization), but it has raised privacy-related concerns which, if not addressed, may affect the users disposition to use network services. At the same time, servers need to regulate service access without disclosing entirely the details of their access control policy. There is therefore a pressing need for privacy-aware techniques to regulate access to services open to the network. We propose an approach for regulating service access and information disclosure on the Web. The approach consists of a uniform formal framework to formulate – and reason about – both service access and information disclosure constraints. It also provides a means for parties to communicate their requirements while ensuring that no private information be disclosed and that the communicated requirements are correct with respect to the constraints.

DOI: 10.3233/JCS-2002-10303

Journal: Journal of Computer Security, vol. 10, no. 3, pp. 241-271, 2002