A privacy preserving model bridging data provider and collector preferences

Abstract

With the increasing amount of data collected by service providers, privacy concerns increase for data owners who provide private data to receive services. Legislative acts require service providers to protect the privacy of customers. Privacy policy frameworks, such as P3P, assist them by describing their privacy policies to customers (e.g. publishing privacy policy on websites). Unfortunately, providing the policies alone does not guarantee that they are actually enforced because privacy is not a key feature of conventional access control models. A privacy-preserving model should consider the privacy preferences of both the data provider and collector. This paper briefly develops a Lattice-based Privacy Aware Access Control (LPAAC) Model that enforces privacy policies, facilitates customization of privacy agreements, and accommodates preferences of both data and service providers. We demonstrate our model's design and feasibility with corresponding privacy catalogues. Examples clarify the usability, and we provide the implementation of our privacy catalogues that show the efficiency and scalability of our model.