Enterprise Privacy Research Articles

Improving Agricultural Product Traceability Using Blockchain.

Most traditional agricultural traceability systems are centralized, which could result in the low reliability of traceability results, enterprise privacy data leakage vulnerabilities, and the generation of information islands. To solve the above problems, we propose a trusted agricultural product traceability system based on the Ethereum blockchain in this paper. We designed a dual storage model of “Blockchain+IPFS (InterPlanetary File System)” to reduce the storage pressure of the blockchain and realize efficient information queries. Additionally, we propose a data privacy protection solution based on some cryptographic primitives and the Merkle Tree that can avoid enterprise privacy and sensitive data leakage. Furthermore, we implemented the proposed system using the Ethereum blockchain platform and provided the cost, performance, and security analysis, as well as compared it with the existing solutions. The results showed that the proposed system is both efficient and feasible and can meet the practical application requirements.

Enterprise Privacy Resource Optimization and Big Data Intelligent Management Strategy Oriented to the Internet of Things.

In the context of the Internet of Things, user privacy leads to the lack of information security and the obscuration of traditional privacy concepts. Therefore, how to ensure information security and protect user privacy is a key issue that enterprises must solve in the process of using the Internet of Things technology. At present, the research on corporate employees' protection of user privacy in the context of the Internet of Things is mostly focused on the technical level, while the legal and management levels are relatively lacking. Based on the definition of the corporate concept in the context of the Internet of Things, this paper uses management and psychology as the research perspective, and based on theory of persuasion, adjustment orientation theory, and reinforcement theory, it discusses the attitudes of corporate employees to protect user privacy in the context of the Internet of Things and behaviour mechanism, constructing a new theoretical model. This experiment uses 0.001 as the step size to change the corresponding threshold size. The interval range is [0.001, 10], and there are a total of 10,000 points in the interval, which is equivalent to 100 million sensor attack tests. According to the above method, 10,000 points of the ROC curve can be obtained by using 10,000 thresholds, and the corresponding ROC curve can be drawn in the coordinate graph, which can intuitively reflect the performance of the VRADS vehicle anomaly real-time detection system. The challenge of data information protection is analyzed, trying to clarify the ideas for the protection of personal data and information in the Internet of Things environment and even lead to employees' rebellious psychology. This article proves that the pertinence and effectiveness of the persuasive content have a positive impact on employees' attitudes towards privacy protection, and it has been further deepened in the context of the Internet of Things. The balance point is to leave enough room for the long-term sustainable development of the Internet of Things industry on the basis of protecting the personal rights and interests of users.

A Methodology for Eliciting Data Privacy Requirements and Resolving Conflicts

Privacy is one of the major concerns of data protection where personal data of individuals are used by enterprises for providing services. To ensure the rights of citizens, different legal authorities, including European Union, have made it mandatory for enterprises to implement certain privacy principles. An enterprise may also have its own set of privacy principles that help provide customized privacy experience to its customers, with the motive of retaining its customer base and weaning away customers from its competitors. To ensure privacy compliance with legal policies, enterprise privacy principles and expectations of customers, the system design should consider the privacy requirements emanating from all these sources. However, the requirements are often expressed in natural languages, which are difficult to interpret for system designers. In this paper, a logic-based methodology is proposed to formally express privacy requirements emanating from all three different sources. The methodology also includes an algorithm to identify and resolve conflicts among elicited privacy requirements. The proposed approach can be considered as the first step towards ensuring privacy compliance. This would help an enterprise to identify conflicting privacy requirements, resolve conflicts as per pre-defined rules and identify implementable privacy principles to enable the management of privacy compliance.

Intelligence Privacy

The amount of data that businesses want to collect to provide services for consumers, and the amount of privacy that consumers are willing to give away seem to be in opposition. Brian Runciman MBCS discussed this with Toby Stevens, of the Security Enterprise Privacy Group, Walid Hadid, Head of Analytics at OgilvyOne and Lance Fisher, Global CIO of SThree.

Open-source intelligence and privacy by design

As demonstrated by other papers on this issue, open-source intelligence (OSINT) by state authorities poses challenges for privacy protection and intellectual-property enforcement. A possible strategy to address these challenges is to adapt the design of OSINT tools to embed normative requirements, in particular legal requirements. The experience of the VIRTUOSO platform will be used to illustrate this strategy. Ideally, the technical development process of OSINT tools is combined with legal and ethical safeguards in such a way that the resulting products have a legally compliant design, are acceptable within society (social embedding), and at the same time meet in a sufficiently flexible way the varying requirements of different end-user groups. This paper uses the analytic framework of privacy design strategies (minimise, separate, aggregate, hide, inform, control, enforce, and demonstrate), arguing that two approaches for embedding legal compliance seem promising to explore in particular. One approach is the concept of revocable privacy with spread responsibility. The other approach uses a policy mark-up language to define Enterprise Privacy Policies, which determine appropriate data handling.Both approaches are tested against three requirements that seem particularly suitable for a ‘compliance by design’ approach in OSINT: purpose specification; collection and use limitation and data minimisation; and data quality (up-to-dateness). For each requirement, the paper analyses whether and to what extent the approach could work to build in the requirement in the system. The paper concludes that legal requirements cannot be embedded fully in OSINT systems. However, it is possible to embed functionalities that facilitate compliance in allowing end-users to determine to what extent they adopt a ‘privacy-by-design’ approach when procuring an OSINT platform, extending it with plug-ins, and fine-tuning it to their needs. The paper argues that developers of OSINT platforms and networks have a responsibility to make sure that end-users are enabled to use privacy by design, by allowing functionalities such as revocable privacy and a policy-enforcement language.

Fine‐grained filtering to provide access control for data providing services within collaborative environments

SummaryA data providing service (DPS) in service‐oriented architecture is tasked only with the retrieval of data that are annotated over a domain ontology. One particular motivating application of DPSs is their use within collaborative environments. An important characteristic for the enterprises of such a collaborative environment is the ability to employ data sharing with one another. A major concern in this situation is the protection of each enterprise's privacy while still permitting data sharing. One potential solution is to provide filtered data through access control. This work describes how to implement access control through fine‐grained filtering of DPS response messages; it is accomplished using a filtering ontology and relations between the domain ontology of DPS and the proposed filtering ontology. Therefore, enterprises can write enterprise‐specific access control policies referencing a common filtering ontology defined within a collaborative environment, enabling access control‐based data sharing within the environment. This work additionally illustrates the implementation of our general solution to data providing web services, interpreted by an eXtensible Access Control Markup Language‐based access control framework. The implementation is further evaluated in a case study of real world data, provided by a health research institute in London, Canada. Copyright © 2013 John Wiley & Sons, Ltd.

Towards high performance security policy evaluation

The Enterprise Privacy Authorization Language (EPAL) is a formal language for specifying fine-grained enterprise privacy policies. With the adoption of EPAL, especially in web applications, the performance of EPAL policy evaluation engines becomes a critical issue. In this paper, we propose Eengine, an engine for efficient EPAL policy evaluation. Eengine first converts all string values in an EPAL policy to numerical values. Second, it converts a numericalized EPAL policy specified as a list of rules following the first-match semantics to a tree structure for efficient processing of numericalized requests.

Engineering Financial Enterprise Content Management Services

The demand is increasing to replace the current cost ineffective and bad time-to-market hardcopy publishing and delivery of content in the financial world. Financial Enterprise Content Management Services (FECMS) have been deployed in intra-enterprises and over the Internet to network with customers. This paper presents Web service technologies that enable a unified scalable FECMS framework for intra-enterprise content flow and inter-enterprise interactions, combining existing sub-systems and disparate business functions. Additionally, the authors demonstrate the key privacy and access control policies for internal content flow management (such as content editing, approval, and usage) as well as external access control for the Web portal and institutional programmatic users. Through the modular design of an integrated FECMS, this research illustrates how to systematically specify privacy and access control policies in each part of the system with Enterprise Privacy Authorization Language (EPAL). Finally, a case study in an international banking enterprise demonstrates how both integration and control can be achieved.

Enabling Personal Privacy for Pervasive Computing Environments

Protection of personal data in the Internet is already a challenge today. Users have to actively look up privacy policies of websites and decide whether they can live with the terms of use. Once discovered, they are forced to make a 'take or leave' decision. In future living and working environments, where sensors and context-aware services are pervasive, this becomes an even greater challenge and annoyance. The environment is much more personalized and users cannot just 'leave'. They require measures to prevent, avoid and detect misuse of sensitive data, as well as to be able to negotiate the purpose of use of data. We present a novel model of privacy protection, complementing the notion of enterprise privacy with the incorporation of personal privacy towards a holistic privacy management system. Our approach allows non-expert users not only to negotiate the desired level of privacy in a rather automated and simple way, but also to track and monitor the whole life-cycle of data.

Identity-based Encryption: From Identity and Access Management to Enterprise Privacy Management

The complex regulatory environment in which businesses currently operates is difficult to understand. It is a bewildering array of legislation that requires the protection of many types of data, or...

Privacy Issues of Applying RFID in Retail Industry

Retail industry poses typical enterprise computing challenges, since a retailer normally deals with multiple parties that belong to different organizations (i.e., suppliers, manufacturers, distributors, end consumers). Capable of enabling retailers to effectively and efficiently manage merchandise transferring among various parties, Radio Frequency Identification (RFID) is an emerging technology that potentially could revolutionize the way retailers do business. With the dramatic price drop of RFID tags, it is possible that RFID could be applied to each item sold by a retailer. However, RFID technology poses critical privacy challenges. If not properly used, the data stored in RFID could be abused and, thus, cause privacy concerns for end consumers. In this article, we first analyze the potential privacy issue of RFID utilization. Then we propose a privacy authorization model that aims to precisely define comprehensive RFID privacy policies. Extended from the role-based access control model, our privacy authorization model ensures the special needs of RFID-related privacy protection. These policies are designed from the perspective of end consumers, whose privacy rights potentially could be violated. Finally, we explore the feasibility of applying Enterprise Privacy Authorization Language (EPAL) as the vehicle for specifying RFID-related privacy rules.