Change search
Link to record
Permanent link

Direct link
BETA
Publications (7 of 7) Show all publications
Reuben, J. & Fischer-Hübner, S. (2017). A Privacy Focused Formal Model of Authorization for Data Modeled using Semantic Web Technologies. In: The Ninth International Conference on Advances in Databases, Knowledge, and Data Applications: . Paper presented at The Ninth International Conference on Advances in Databases, Knowledge, and Data Applications.
Open this publication in new window or tab >>A Privacy Focused Formal Model of Authorization for Data Modeled using Semantic Web Technologies
2017 (English)In: The Ninth International Conference on Advances in Databases, Knowledge, and Data Applications, 2017Conference paper, Published paper (Refereed)
Abstract [en]

Origin of digital artifacts is asserted by digital provenance information. Provenance information is queried for proof statement validations, failure analysis, as well as replication and attribution validations. The history of data that specifies dependency among different data items that produce the data is better captured using semantic web technologies. However, such provenance information contains sensitive information such as personally identifiable information. Further, in the context of Semantic Web knowledge representation, the interrelationships among different provenance elements imply additional knowledge. In this paper, we propose an authorization model that enforces the purpose limitation principle for such semantically related information. We present the formalization of the security policy, however the policy does not reflect the direct implementation of the desired authorization. Therefore, security properties for important relationships such as sub set, set union and set intersection are defined in order to ensure consistency of the security policy. Finally, a use case scenario demonstrating the defined security policy and the properties is presented to indicate the applicability of the proposed model

National Category
Computer Systems
Research subject
Computer Science
Identifiers
urn:nbn:se:kau:diva-48549 (URN)
Conference
The Ninth International Conference on Advances in Databases, Knowledge, and Data Applications
Available from: 2017-05-10 Created: 2017-05-10 Last updated: 2019-11-14Bibliographically approved
Reuben, J. (2017). Privacy-aware Use of Accountability Evidence. (Licentiate dissertation). Karlstads universitet
Open this publication in new window or tab >>Privacy-aware Use of Accountability Evidence
2017 (English)Licentiate thesis, comprehensive summary (Other academic)
Abstract [en]

This thesis deals with the evidence that enable accountability, the privacy risks involved in using them and a privacy-aware solution to the problem of unauthorized evidence disclosure. 

Legal means to protect privacy of an individual is anchored on the data protection perspective i.e., on the responsible collection and use of personal data. Accountability plays a crucial role in such legal privacy frameworks for assuring an individual’s privacy. In the European context, accountability principle is pervasive in the measures that are mandated by the General Data Protection Regulation. In general, these measures are technically achieved through automated privacy audits. System traces that record the system activities are the essential inputs to those automated audits. Nevertheless, the traces that enable accountability are themselves subject to privacy risks, because in most cases, they inform about processing of the personal data. Therefore, ensuring the privacy of the accountability traces is equally important as ensuring the privacy of the personal data. However, by and large, research involving accountability traces is concerned with storage, interoperability and analytics challenges rather than on the privacy implications involved in processing them.

This dissertation focuses on both the application of accountability evidence such as in the automated privacy audits and the privacy aware use of them. The overall aim of the thesis is to provide a conceptual understanding of the privacy compliance research domain and to contribute to the solutions that promote privacy-aware use of the traces that enable accountability. To address the first part of the objective, a systematic study of existing body of knowledge on automated privacy compliance is conducted. As a result, the state-of-the-art is conceptualized as taxonomies. The second part of the objective is accomplished through two results; first, a systematic understanding of the privacy challenges involved in processing of the system traces is obtained, second, a model for privacy aware access restrictions are proposed and formalized in order to prevent illegitimate access to the system traces. Access to accountability traces such as provenance are required for automatic fulfillment of accountability obligations, but they themselves contain personally identifiable information, hence in this thesis we provide a solution to prevent unauthorized access to the provenance traces.

Abstract [en]

This thesis deals with the evidence that enables accountability, the privacy risks involved in using it and proposes a privacy-aware solution for preventing unauthorized evidence disclosure.

Accountability plays a crucial role in the legal privacy frameworks for assuring individuals’ privacy.  In the European context, accountability principle is pervasive in the measures that are mandated by the General Data Protection Regulation. In general, these measures are technically achieved through automated privacy audits. Traces that record the system activities are the essential inputs to those audits. Nevertheless, such traces that enable accountability are themselves subject to privacy risks, because in most cases, they inform about the processing of the personal data. Therefore, ensuring the privacy of the traces is equally important as ensuring the privacy of the personal data. The aim of the thesis is to provide a conceptual understanding of the automated privacy compliance research and to contribute to the solutions that promote privacy-aware use of the accountability traces. This is achieved in this dissertation through a systematic study of the existing body of knowledge in automated privacy compliance, a systematic analysis of the privacy challenges involved in processing the traces and a proposal of a privacy-aware access control model for preventing illegitimate access to the traces.

Place, publisher, year, edition, pages
Karlstads universitet, 2017. p. 79
Series
Karlstad University Studies, ISSN 1403-8099 ; 2017:24
Keywords
Privacy, accountability, audit, evidence, system traces, provenance, access control, privacy compliance, security
National Category
Computer Systems
Research subject
Computer Science
Identifiers
urn:nbn:se:kau:diva-48550 (URN)978-91-7063-788-9 (ISBN)978-91-7063-789-6 (ISBN)
Presentation
2017-06-12, 21A342, Eva Eriksson salen, Universitetsgatan 2, Karlstad, 13:15 (English)
Opponent
Supervisors
Available from: 2017-05-22 Created: 2017-05-10 Last updated: 2019-06-17Bibliographically approved
Reuben, J., Martucci, L. A. & Fischer-Hübner, S. (2016). Automated Log Audits for Privacy Compliance Validation: A Literature Survey. In: Privacy and Identity Management. Time for a Revolution?: 10th IFIP WG 9.2, 9.5, 9.6/11.7, 11.4, 11.6/SIG 9.2.2 International Summer School, Edinburgh, UK, August 16-21, 2015, Revised Selected Papers. Paper presented at The IFIP Summer School 2015, Edinburgh, 16-21 August 2015. (pp. 312-326). Springer, 476
Open this publication in new window or tab >>Automated Log Audits for Privacy Compliance Validation: A Literature Survey
2016 (English)In: Privacy and Identity Management. Time for a Revolution?: 10th IFIP WG 9.2, 9.5, 9.6/11.7, 11.4, 11.6/SIG 9.2.2 International Summer School, Edinburgh, UK, August 16-21, 2015, Revised Selected Papers, Springer, 2016, Vol. 476, p. 13p. 312-326Conference paper, Published paper (Refereed)
Abstract [en]

Log audits are the technical means to retrospectively reconstruct and analyze system activities for determining if the system events are in accordance with the rules. In the case of privacy compliance, compliance by detection approaches are promoted for achieving data protection obligations such as accountability and transparency. However significant challenges remain to fulfill privacy requirements through these approaches. This paper presents a systematic literature review that reveals the theoretical foundations of the state-of-art detective approaches for privacy compliance. We developed a taxonomy based on the technical design describing the contextual relationships of the existing solutions. The technical designs of the existing privacy detection solutions are primarily classified into privacy misuse detection and privacy anomaly detection. However, the design principles of these solutions are, to validate need-to-know and access control obligations hence the state-of-art privacy compliance validation mechanisms focus on usage limitations and accountability. The privacy compliance guarantee they provide is subtle when compared to the requirements arising from privacy regulations and data protection obligations.

Place, publisher, year, edition, pages
Springer, 2016. p. 13
Series
IFIP Advances in Information and Communication Technology, ISSN 1868-4238 ; 476
Keywords
Log audit, privacy violation detection, privacy compliance, accountability, transparency
National Category
Computer and Information Sciences
Research subject
Computer Science
Identifiers
urn:nbn:se:kau:diva-38920 (URN)10.1007/978-3-319-41763-9_21 (DOI)978-3-319-41762-2 (ISBN)978-3-319-41763-9 (ISBN)
Conference
The IFIP Summer School 2015, Edinburgh, 16-21 August 2015.
Funder
EU, FP7, Seventh Framework Programme, FP7-ICT-2011-8-317550-A4CLOUD
Note

The school has a two-phase review process for submitted papers. In the first phase submitted papers (short versions) are reviewed and selected for presentation at the school. After the school, these papers can be revised (so that they can benefit from the discussion that occurred at the school) and are then reviewed again for inclusion in the school’s proceedings which will be published by Springer.

Available from: 2015-12-18 Created: 2015-12-18 Last updated: 2018-11-06Bibliographically approved
Reuben, J., Martucci, L. A., Fischer-Hübner, S., Packer, H., Hedbom, H. & Moreau, L. (2016). Privacy Impact Assessment Template for Provenance. In: Proceedings of 2016 11th International Conference on Availability, Reliability and Security, (Ares 2016): . Paper presented at 11th International Conference on Availability, Reliability and Security (ARES). Salzburg, Austria. Aug 31-sep 02, 2016. (pp. 653-660). IEEE
Open this publication in new window or tab >>Privacy Impact Assessment Template for Provenance
Show others...
2016 (English)In: Proceedings of 2016 11th International Conference on Availability, Reliability and Security, (Ares 2016), IEEE, 2016, p. 653-660Conference paper, Published paper (Refereed)
Place, publisher, year, edition, pages
IEEE, 2016
National Category
Computer and Information Sciences
Research subject
Computer Science
Identifiers
urn:nbn:se:kau:diva-43020 (URN)10.1109/ARES.2016.95 (DOI)000391214400081 ()978-1-5090-0990-9 (ISBN)
Conference
11th International Conference on Availability, Reliability and Security (ARES). Salzburg, Austria. Aug 31-sep 02, 2016.
Projects
Smart Society
Available from: 2016-06-15 Created: 2016-06-15 Last updated: 2019-11-10Bibliographically approved
Pais, R., Wiktor Wlodarczyk, T., Rübsamen, T., Reich, C., Azraoui, M., Royer, J.-C., . . . Felici, M. (2015). D:C-8.2 Framework of Evidence.
Open this publication in new window or tab >>D:C-8.2 Framework of Evidence
Show others...
2015 (English)Report (Refereed)
Publisher
p. 60
National Category
Computer and Information Sciences
Research subject
Computer Science
Identifiers
urn:nbn:se:kau:diva-38917 (URN)
Projects
A4Cloud
Funder
EU, FP7, Seventh Framework Programme, FP7-ICT-2011-8-317550-A4CLOUD
Available from: 2015-12-18 Created: 2015-12-18 Last updated: 2018-01-10Bibliographically approved
Wiktor Wlodarczyk, T., Pais, R., Azraoui, M., Önen, M., Reuben, J., Pulls, T., . . . Bernsmed, K. (2015). D:C-8.3 Automation Service for the Framework of Evidence.
Open this publication in new window or tab >>D:C-8.3 Automation Service for the Framework of Evidence
Show others...
2015 (English)Report (Refereed)
Publisher
p. 54
National Category
Computer and Information Sciences
Research subject
Computer Science
Identifiers
urn:nbn:se:kau:diva-38918 (URN)
Funder
EU, FP7, Seventh Framework Programme, FP7-ICT-2011-8-317550-A4CLOUD
Available from: 2015-12-18 Created: 2015-12-18 Last updated: 2018-01-10
Angulo, J., Berthold, S., Elkhiyaoui, K., Fernandez Gago, M. C., Fischer-Hübner, S., David, N., . . . Önen, M. (2015). D:D-5.3 User-Centric Transparency Tools V2.
Open this publication in new window or tab >>D:D-5.3 User-Centric Transparency Tools V2
Show others...
2015 (English)Report (Refereed)
Publisher
p. 57
National Category
Computer and Information Sciences
Research subject
Computer Science
Identifiers
urn:nbn:se:kau:diva-38919 (URN)
Funder
EU, FP7, Seventh Framework Programme, FP7-ICT-2011-8-317550-A4CLOUD
Available from: 2015-12-18 Created: 2015-12-18 Last updated: 2018-06-04Bibliographically approved
Organisations
Identifiers
ORCID iD: ORCID iD iconorcid.org/0000-0001-9535-6621

Search in DiVA

Show all publications