Purpose based access control for privacy protection in relational database systems

Abstract In this article, we present a comprehensive approach for privacy preserving access control based on the notion of purpose. In our model, purpose information associated with a given data element specifies the intended use of the data element. A key feature of our model is that it allows multiple purposes to be associated with each data element and also supports explicit prohibitions, thus allowing privacy officers to specify that some data should not be used for certain purposes. An important issue addressed in this article is the granularity of data labeling, that is, the units of data with which purposes can be associated. We address this issue in the context of relational databases and propose four different labeling schemes, each providing a different granularity. We also propose an approach to representing purpose information, which results in low storage overhead, and we exploit query modification techniques to support access control based on purpose information. Another ...

• Type: Conference
• Year: 2008
• Where: VLDB
• Authors: Ji-Won Byun, Ninghui Li
• Keywords: Access Control, Data Element, Database, Role-based Access Control, VLDB 2008