A Lattice-Based Privacy Aware Access Control Model

As the amount of data being collected by service providers increases, privacy concerns increase for the data owners that must provide private data to get services. Legislative acts require enterprises protect the privacy of their customers and privacy policy frameworks such as P3P assist enterprises in demonstrating their privacy policies to customers (i.e. publishing privacy policy on Websites). Unfortunately, defining these standards does not guarantee that the privacy policies are actually enforced since privacy is not central to conventional access control models. Furthermore, a privacy-preserving model should consider the privacy preferences of both data provider and data collector. This paper presents a lattice-based privacy aware access control (LPAAC) model. The key contribution is providing a privacy preserving model that enforces privacy policies and facilitates customization of privacy agreements and preferences of both data providers and organizations that collect data.