Projects/QH/P3P - Related Work

The amount of work performed on P3P-related issues is huge, as is work on Role-based access control. We will not attempt to survey these areas per se. Such surveys can be found in public sources. The canonical site for RBAC is http://csrc.nist.gov/rbac/, and for P3P it is http://www.w3.org/P3P/.

We will rather highlight some of the few instances of work that tries to connect roled-based access control (in different forms) to P3P (or related privacy approaches). For most of these references, a few remarks are made.

• AT&T: AT&T Privacy Bird
  Site providing a downlodable user-agent plugin
• Peter J. Brown and Gareth J. F. Jones: Context-awareness and privacy: an inevitable clash? . Department of Computer Science, University of Exeter, Exeter, EX4 4PT, United Kingdom
  Identifies RBAC as a strong, yet complex, technology for privacy protection in the area of preventative measures.
Lorrie Cranor et al.: The Platform for Privacy Preferences 1.0 (P3P1.0) Specification W3C Recommendation April 16, 2002
Lorrie Cranor, Marc Langheinrich and Massimo Marchiori: A P3P Preference Exchange Language 1.0 (APPEL1.0) W3C Working Draft, April 15, 2002
• Maria R. Ebling, Guerney D. H. Hunt and Hui Lei: Issues for Context Services for Pervasive Computing , , Workshop on Middleware for Mobile Computing, Heidelberg, Germany. November 16, 2001.
  Proposes a privacy-protection mechanism based on role-based access control, where context is a key concept
• John S. Erickson: Information Objects and Rights Management - A Mediation-based Approach to DRM Interoperability . D-Lib Magazine, April 2001, Volume 7, Number 4.
  Revisits and evaluates different technologies from a DRM/IPR point of view, including P3P and RBAC, which have certain advantages in this application area, as well as certain disadvantages. But they do offer support in unique and complementary areas.
• European Joint Research center: http://p3p.jrc.it/
  Site describing the work done at JRC on P3P and APPEL.
• Qingfeng He: Privacy Enforcement with an Extended Role-Based Access Control Model . NCSU Computer Science Technical Report TR-2003-09, February 28, 2003.
  The paper proposes an extended role-based access control model, PARBAC (Privacy-Aware Role-Based Access Control), for enforcing privacy policies within an organization.
• Qingfeng He and Annie I. Anton: A Framework for Modeling Privacy Requirements in Role Engineering , Ninth International Workshop on Requirements Engineering: Foundation for Software Quality. , Klagenfurt/Velden, Austria, June 6 -17, 2003.
  Proposes a framework for modelling privacy requirements in role engineering.
• Xiaodong Jiang, Jason Hong and James Landay: Approximate Information Flows: Socially-based Modeling of Privacy in Ubiquitous Computing . Proceedings of Fourth International Conference on Ubiquitous Computing (Ubicomp'2002) , Sep 29 - Oct 1, 2002, Gothenburg, Sweden.
  As part of their analysis of the design space for privacy solutions in ubiquitous computing, they highlight the complementarity between traditional RBAC and specific privacy technology, like P3P.
• Graham Klyne: Scenarios for using RDF in support of Trust and Access Control . SWAD-Europe memo, Nine by Nine, Abingdon, Oxon, UK, December 18, 2002
  Surveys the possible use of RDF for trust and access control. Among other things, its application to role-based access control and P3P are indicated.
• Alfred Kobsa.: Pseudonymous yet Personalized Interaction with Websites that Utilize Network-wide User Modeling Services . HCIC Winter Workshop, Winter Park, CO, 2003.
  A reference architecture for fully personalized interaction is outlined. User roles and application types are associated with whatever data categories may be disclosed to these applications (e.g.,P3P categories), and the roles mentioned are conceptualised ccording to the RBAC model
• Alfred Kobsa and jörg Schreck: Privacy Through Pseudonymity in User-Adaptive Systems . ACM Transactions on Internet Technology, Vol. 3, No. 2, May 2003, pp. 149-183.
  Investigates user-adaptive systems, and the interdependence of system information and user information, and its impact on privacy. A version of rolebased access control forms the foundation of supervising the communication between application systems and the user model.
• Hui Lei, Daby M. Sow, John S. Davis, II, Guruduth Banavar and Maria R. Ebling: The design and applications of a context service . , ACM SIGMOBILE Mobile Computing and Communications Review, vol 6, no. 4, pp 44-55, 2002
  Describes the architecture of a Context Service. The associated privacy protection engine is based role-based access control.
• Brian McBride, Rigo Wenning and Lorrie Cranor: An RDF Schema for P3P W3C Note, January 25, 2002
• Microsoft: P3P in Internet Explorer
  [Third-party] description of P3P and Internet Explorer
• Mozilla: P3P in Mozilla
  Describes what is going on in the context of Mozilla, w.r.t. P3P
• NIST: An Introduction to Role Based Access Control NIST CSL Bulletin on RBAC, December, 1995.
• Charles C. Palmer: Privacy Technology, Today & Tomorrow . IAPO Privacy & Security Academy & Expo, Chicago Marriott Downtown, Chicago, IL, October 16-18, 2002.
  Characterises the way role-based access control can support privacy.
• Ravi Sandhu and Trent Jaeger (eds): Proceedings of the sixth ACM symposium on Access control models and technologies, ACM Workshop on Role Based Access Control, Chantilly, Virginia, United States. ACM Press, New York, NY, USA, 2001

This activity was partly supported by grant IST-2000-28767 from the European Union's Information Society Programme to the Question How project