Skip to main content

2015 | OriginalPaper | Buchkapitel

A-PPL: An Accountability Policy Language

verfasst von : Monir Azraoui, Kaoutar Elkhiyaoui, Melek Önen, Karin Bernsmed, Anderson Santana De Oliveira, Jakub Sendor

Erschienen in: Data Privacy Management, Autonomous Spontaneous Security, and Security Assurance

Verlag: Springer International Publishing

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract

Cloud Computing raises various security and privacy challenges due to the customers’ inherent lack of control over their outsourced data. One approach to encourage customers to take advantage of the cloud is the design of new accountability solutions which improve the degree of transparency with respect to data processing. In this paper, we focus on accountability policies and propose A-PPL, an accountability policy language that represents machine-readable accountability policies. A-PPL extends the PPL language by allowing customers to define additional rules on data retention, data location, logging and notification. The use of A-PPL is illustrated with a use case where medical sensors collect personal data which are then stored and processed in the cloud. We define accountability obligations related to this use case and translate them into A-PPL policies as a proof of concept of our proposal.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Fußnoten
2
Violations are detected by an external tool that takes A-PPL policies as inputs.
 
Literatur
1.
Zurück zum Zitat Azraoui, M., Elkhiyaoui, K., Önen, M., Bernsmed, K., de Oliveira, A.S., Sendor, J.: A-PPL: An Accountability Policy Language. Technical report (2014) Azraoui, M., Elkhiyaoui, K., Önen, M., Bernsmed, K., de Oliveira, A.S., Sendor, J.: A-PPL: An Accountability Policy Language. Technical report (2014)
2.
Zurück zum Zitat Bernsmed, K., Felici, M., de Oliveira, A.S., Sendor, J., Moe, N.B., Rübsamen, T., Tountopoulos, V., Hasnain, B.: Use case descriptions. Deliverable, Cloud Accountability (A4Cloud) Project (2013) Bernsmed, K., Felici, M., de Oliveira, A.S., Sendor, J., Moe, N.B., Rübsamen, T., Tountopoulos, V., Hasnain, B.: Use case descriptions. Deliverable, Cloud Accountability (A4Cloud) Project (2013)
3.
Zurück zum Zitat Bernsmed, K., Kuan, H., Millard, C.: Deploying Medical Sensor Networks in the Cloud - Accountability Obligations from a European Perspective. Submitted for publication (2014) Bernsmed, K., Kuan, H., Millard, C.: Deploying Medical Sensor Networks in the Cloud - Accountability Obligations from a European Perspective. Submitted for publication (2014)
4.
Zurück zum Zitat Butin, D., Chicote, M., Le Métayer, D.: Log design for accountability. In: 2013 IEEE Security and Privacy Workshops (SPW), pp. 1–7. IEEE (2013) Butin, D., Chicote, M., Le Métayer, D.: Log design for accountability. In: 2013 IEEE Security and Privacy Workshops (SPW), pp. 1–7. IEEE (2013)
5.
Zurück zum Zitat Cherrueau, R.-A., Douence, R., Grall, H., Royer, J.-C., Sellami, M., Südholt, M., Azraoui, M., Elkhiyaoui, K., Molva, R., Önen, M., Garaga, A., de Oliveira, A.S., Sendor, J., Bernsmed, K.: Policy representation framework. Deliverable (to be published), Cloud Accountability (A4Cloud) Project (2013) Cherrueau, R.-A., Douence, R., Grall, H., Royer, J.-C., Sellami, M., Südholt, M., Azraoui, M., Elkhiyaoui, K., Molva, R., Önen, M., Garaga, A., de Oliveira, A.S., Sendor, J., Bernsmed, K.: Policy representation framework. Deliverable (to be published), Cloud Accountability (A4Cloud) Project (2013)
6.
Zurück zum Zitat Cuppens, F., Cuppens-Boulahia, N.: Modeling contextual security policies. Int. J. Inf. Secur. 7(4), 285–305 (2008)CrossRef Cuppens, F., Cuppens-Boulahia, N.: Modeling contextual security policies. Int. J. Inf. Secur. 7(4), 285–305 (2008)CrossRef
7.
Zurück zum Zitat European Parliament. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1995) European Parliament. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (1995)
8.
Zurück zum Zitat Henze, M., Großfengels, M., Koprowski, M., Wehrle, K.: Towards data handling requirements-aware cloud computing. In: 2013 IEEE International Conference on Cloud Computing Technology and Science (CloudCom) (2013) Henze, M., Großfengels, M., Koprowski, M., Wehrle, K.: Towards data handling requirements-aware cloud computing. In: 2013 IEEE International Conference on Cloud Computing Technology and Science (CloudCom) (2013)
10.
Zurück zum Zitat Li, N., Chen, H., Bertino, E.: On practical specification and enforcement of obligations. In: Proceedings of the Second ACM Conference on Data and Application Security and Privacy, pp. 71–82. ACM (2012) Li, N., Chen, H., Bertino, E.: On practical specification and enforcement of obligations. In: Proceedings of the Second ACM Conference on Data and Application Security and Privacy, pp. 71–82. ACM (2012)
11.
Zurück zum Zitat Lin, A., Chen, N.-C.: Cloud computing as an innovation: percepetion, attitude, and adoption. Int. J. Inf. Manage. 32(6), 533–540 (2012)CrossRef Lin, A., Chen, N.-C.: Cloud computing as an innovation: percepetion, attitude, and adoption. Int. J. Inf. Manage. 32(6), 533–540 (2012)CrossRef
13.
Zurück zum Zitat Papagiannakopoulou, E.I., et al.: Leveraging ontologies upon a holistic privacy-aware access control model. In: Danger, J.L., Debbabi, M., Marion, J.-Y., Garcia-Alfaro, J., Heywood, N.Z. (eds.) FPS 2013. LNCS, vol. 8352, pp. 209–226. Springer, Heidelberg (2014)CrossRef Papagiannakopoulou, E.I., et al.: Leveraging ontologies upon a holistic privacy-aware access control model. In: Danger, J.L., Debbabi, M., Marion, J.-Y., Garcia-Alfaro, J., Heywood, N.Z. (eds.) FPS 2013. LNCS, vol. 8352, pp. 209–226. Springer, Heidelberg (2014)CrossRef
14.
Zurück zum Zitat Pearson, S., Tountopoulos, V., Catteddu, D., Sudholt, M., Molva, R., Reich, C., Fischer-Hubner, S., Millard, C., Lotz, V., Jaatun, M., Leenes, R., Rong, C., Lopez, J.: Accountability for cloud and other future internet services. In: 2012 IEEE 4th International Conference on Cloud Computing Technology and Science (CloudCom), pp. 629–632 (2012) Pearson, S., Tountopoulos, V., Catteddu, D., Sudholt, M., Molva, R., Reich, C., Fischer-Hubner, S., Millard, C., Lotz, V., Jaatun, M., Leenes, R., Rong, C., Lopez, J.: Accountability for cloud and other future internet services. In: 2012 IEEE 4th International Conference on Cloud Computing Technology and Science (CloudCom), pp. 629–632 (2012)
15.
Zurück zum Zitat Trabelsi, S., Neven, G., Raggett, D., Ardagna, C., Bournez, C., Bussard, L., Bezzi, M., Camenisch, J., de Capitani di Vimercati, S., Gey, F., Kuczerawy, A., Meissner, S., Neven, G., Njeh, A., Paraboschi, S., Pedrini, E., Foresti, S., Pinsdorf, U., Preiss, F.-S., Sendor, J., Tziviskou, C., Raggett, D., Roessler, T., Samarati, P., Schallaboeck, J., Short, S., Sommer, D., Verdicchio, M., Wenning, R.: D5.3.4 - report on design and implementation of the primelife policy language and engine. Deliverable, Primelife Project (2011) Trabelsi, S., Neven, G., Raggett, D., Ardagna, C., Bournez, C., Bussard, L., Bezzi, M., Camenisch, J., de Capitani di Vimercati, S., Gey, F., Kuczerawy, A., Meissner, S., Neven, G., Njeh, A., Paraboschi, S., Pedrini, E., Foresti, S., Pinsdorf, U., Preiss, F.-S., Sendor, J., Tziviskou, C., Raggett, D., Roessler, T., Samarati, P., Schallaboeck, J., Short, S., Sommer, D., Verdicchio, M., Wenning, R.: D5.3.4 - report on design and implementation of the primelife policy language and engine. Deliverable, Primelife Project (2011)
Metadaten
Titel
A-PPL: An Accountability Policy Language
verfasst von
Monir Azraoui
Kaoutar Elkhiyaoui
Melek Önen
Karin Bernsmed
Anderson Santana De Oliveira
Jakub Sendor
Copyright-Jahr
2015
DOI
https://doi.org/10.1007/978-3-319-17016-9_21

Premium Partner