3 research outputs found
A Data Protection Architecture for Derived Data Control in Partially Disconnected Networks
Every organisation needs to exchange and disseminate data constantly amongst its employees, members, customers
and partners. Disseminated data is often sensitive or confidential and access to it should be restricted to
authorised recipients. Several enterprise rights management (ERM) systems and data protection solutions have
been proposed by both academia and industry to enable usage control on disseminated data, i.e. to allow data
originators to retain control over whom accesses their information, under which circumstances, and how it is
used. This is often obtained by means of cryptographic techniques and thus by disseminating encrypted data
that only trustworthy recipients can decrypt. Most of these solutions assume data recipients are connected to
the network and able to contact remote policy evaluation authorities that can evaluate usage control policies and
issue decryption keys. This assumption oversimplifies the problem by neglecting situations where connectivity
is not available, as often happens in crisis management scenarios. In such situations, recipients may not be
able to access the information they have received. Also, while using data, recipients and their applications can
create new derived information, either by aggregating data from several sources or transforming the original
data’s content or format. Existing solutions mostly neglect this problem and do not allow originators to retain
control over this derived data despite the fact that it may be more sensitive or valuable than the data originally
disseminated.
In this thesis we propose an ERM architecture that caters for both derived data control and usage control in
partially disconnected networks. We propose the use of a novel policy lattice model based on information flow
and mandatory access control. Sets of policies controlling the usage of data can be specified and ordered in a
lattice according to the level of protection they provide. At the same time, their association with specific data
objects is mandated by rules (content verification procedures) defined in a data sharing agreement (DSA) stipulated
amongst the organisations sharing information. When data is transformed, the new policies associated
with it are automatically determined depending on the transformation used and the policies currently associated
with the input data. The solution we propose takes into account transformations that can both increase or reduce
the sensitivity of information, thus giving originators a flexible means to control their data and its derivations.
When data must be disseminated in disconnected environments, the movement of users and the ad hoc connections they establish can be exploited to distribute information. To allow users to decrypt disseminated data
without contacting remote evaluation authorities, we integrate our architecture with a mechanism for authority
devolution, so that users moving in the disconnected area can be granted the right to evaluate policies and issue
decryption keys. This allows recipients to contact any nearby user that is also a policy evaluation authority to
obtain decryption keys. The mechanism has been shown to be efficient so that timely access to data is possible
despite the lack of connectivity. Prototypes of the proposed solutions that protect XML documents have been
developed. A realistic crisis management scenario has been used to show both the flexibility of the presented
approach for derived data control and the efficiency of the authority devolution solution when handling data
dissemination in simulated partially disconnected networks.
While existing systems do not offer any means to control derived data and only offer partial solutions to
the problem of lack of connectivity (e.g. by caching decryption keys), we have defined a set of solutions
that help data originators faced with the shortcomings of current proposals to control their data in innovative,
problem-oriented ways
Maintaining Privacy on Derived Objects
Protecting privacy means to ensure users that access to their personal data complies with their preferences. However, information can be manipulated in order to derive new objects that may disclose part of the original information. Therefore, control of information flow is necessary for guaranteeing privacy protection since users should know and control not only who access their personal data, but also who access information derived from their data. Actually, current approaches for access control do not provide support for managing propagation of information and for representing user preferences. This pape