Privacy and Identity Management for Life

Name: Privacy and Identity Management for Life | 7th IFIP WG 9.2, 9.6/11.7, 11.4, 11.6 International Summer School, Trento, Italy, September 5-9, 2011, Revised Selected Papers
Brand: Springer
Price: 53.49 EUR
Availability: OnlineOnly

7th IFIP WG 9.2, 9.6/11.7, 11.4, 11.6 International Summer School, Trento, Italy, September 5-9, 2011, Revised Selected Papers

Jan Camenisch Bruno Crispo Simone Fischer-Hübner Ronald Leenes Giovanni Russello(Herausgeber*in)

Springer (Verlag)

Erschienen am 28. Juni 2012

XIV, 294 Seiten

E-Book

PDF mit Wasserzeichen-DRM

Systemvoraussetzungen

978-3-642-31668-5 (ISBN)

53,49 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Wasserzeichen-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Title
Preface
Organization
Table of Contents
Invited Talks
Are They Making Our Privates Public? - Emerging Risks of Governmental Open Data Initiatives
Introduction
New York's NYC Datamine - Fat Fingers at the Data Office
Philadelphia's Open Data Philly - Too Much Sharing
Canada's Open Data Framework - Are Elephants Feasible?
Edmonton's Election Results - Did My Wife Vote for Me?
Europe's Open Data Challenge - Bring on the Lawyers
Should the Rich Have Less Privacy?
Indirect Risks of Releasing Government Data
The Implications of De-anonymnization Techniques
A Carpenter Is Only as Good as His Tools
The Rise of "Super-Public" Data
Conclusions and Recommendations
References
Top 10 Mistakes in System Design from a Privacy Perspective and Privacy Protection Goals
Introduction
Privacy Perspective
Classical Definitions of "Privacy" and "Data Protection"
Data Protection Principles
Extended Notion of Privacy
Top 10 Mistakes in System Design from a Privacy Perspective
Mistake 1: Storage as Default
Mistake 2: Linkability as Default
Mistake 3: Real Name as Default
Mistake 4: Function Creep as Feature
Mistake 5: Fuzzy or Incomplete Information as Default
Mistake 6: "Location Does Not Matter"
Mistake 7: No Lifecycle Assessment
Mistake 8: Changing Assumptions or Surplus Functionality
Mistake 9: No Intervenability Foreseen
Mistake 10: Consent Not Providing a Valid Legal Ground
Privacy Protection Goals
Working with Protection Goals
Privacy Protection Goals
Working with Privacy Protection Goals
Positioning the Protection Goals with Regard to Related Approaches
Conclusion and Outlook
References
Privacy Metrics and Comparison
Developing a Strategy for Automated Privacy Testing Suites
Introduction
Testing in the EnCoRe System
Testing Strategy
Procedure 1: Eliciting Test Requirements
Procedure 2: Producing Test Suites
Applying the Testing Strategy to a Real Case Study
Mary Is Hired by Company X
Mary Leaves the Company
Conclusion and Future Work
References
Assessing Formal Independence of Data Protection Authorities in a Comparative Perspective
Introduction
The Concept of the Regulatory State and Independent Regulatory Agencies
Independence of IRAs
The EU Data Protection Directive and the Role of DPAs
Independence of DPAs
Case Selection
The German Case
The Polish DPA
The Swedish Data Inspection Board
Conclusion
References
Policies
Extracting Access Control and Conflict Resolution Policies from European Data Protection Law
Introduction
Related Work
Methodology
Step 1. Identifying Provisions of the EDPD Related to Access Control
Step 2. Extracting the Legal Access Control Policy
Step 3. Refining the Access Control Rules
Step 4. Formalizing the Access Control Rules
Step 5. Attribute Determination
Validation Test Results
Conclusion and Future Work
References
Early Lessons Learned in the ENDORSE Project: Legal Challenges and Possibilities in Developing Data Protection Compliance Software
Introduction
Sources of Law and the Complexities of Scoping and Fragmentation
Legal Hierarchy and the Complexity of Legal Norm Conflicts
Interpretation of Legal Norms and Open Texture
Open Legal Norms and Choice Architecture
Implementation of Choice Architecture within Compliance Software
Choice Architecture and Previous Work
Conclusions
References
Privacy and Transparency in the Age of Cloud Computing
The Infrastructure Level of Cloud Computing as a Basis for Privacy and Securityof Software Services
Introduction
Adversary Model
Technical Requirements Derived from the Regulatory Framework
Requirements Derived from the Data Protection Directive
Requirements Derived from the E-Privacy Directive
Prototype
Technical and Organisational Measures Addressing the Requirements Identified
Add, Remove Systems
Change Systems
Monitoring, Backup, Restore
Troubleshooting
Auditing
Remaining Risks
Related Work
Conclusion
References
(More) Side Channels in Cloud Storage Linking Data to Users
Introduction
Deduplication
Related Work
Adversary Model
Linking Files and Users
A Formalised Attack
Wuala - Distributed Storage among Users
BitTorrent - Efficient File Sharing and Linkability
Freenet - Anonymous Distributed and Decentralised Storage
Tahoe-LAFS - Multiple Storage Providers
Summary
Profiling Users' Usage
Observing Storage
Mitigating Profiling
Conclusion
References
Who Got All of My Personal Data? Enabling Users to Monitor the Proliferation of Shared Personally Identifiable Information
Motivation
Related Work
Contrasting Provider- and User-Based Information Management
Identity Management and Related Experiences at KIT
User-Based Federations
Contrasting Inside and Outside Perspectives
Information Management Assistance System
Contrasting an IMAS with User-Centricity and Transparency Enhancing Technologies
A Building Block for Reactive IMAS Components
Conclusions
References
Privacy for Mobile Applications
Exploring Touch-Screen Biometrics for User Identification on Smart Phones
Introduction
Related Work
Requirements and Research Questions
Experimental Setup
Data Collection and Analysis
Implications and Discussions
Conclusions and Future Work
References
Using a Smartphone to Access Personalized Web Services on a Workstation
Introduction
Requirements
Functional Requirements
Usability Requirements
Security and Privacy Requirements
Attack Models
Design
Prototype
Trusted Module Application
Smartphone Application
Server Extensions
Evaluation
Validation against Attack Models
Comparison with Other Solutions
Discussion
Conclusion
References
Designing Privacy-Enhancing Mobile Applications
Introduction
Multi-paradigm Modelling
Mobile Access Control Scenarios
Assessment of the Methodology in the Context of Mobile Access Control Systems
Constraints in the Context of Mobile Applications
Extending the Existing Design Methodology
Realization
Modelling with ATo$M^3$
Petri Net Model
Coarse-Grained Linkability Graph
Towards a Transformation from a Petri Net Model to a Coarse-Grained Linkability Graph
Towards Mobile Access to the e-Shop
Conclusions and Future Work
References
Consumer Privacy
Extending Comparison Shopping Sites by Privacy Information on Retailers
Introduction
Related Work
Taking a Closer Look at Our Setting
Customer
Provider of a Comparison Shopping Site
Retailer
Privacy Evaluation Function Provider
Privacy Evaluation Provider
Interaction Overview
The Privacy Evaluation Function - A First Approximation
Implementing a Privacy Evaluation Function for a Retailer's Privacy-Relevant Properties
Interface Definition
Information Flow for the Evaluation Code
Example of an Evaluation Function
Other Possible Properties to Be Evaluated
User Interface Considerations
The Privacy Evaluation Item
Colouring
Positioning
Conclusion and Outlook
References
Do-Not-Track Techniques for Browsers and Their Implications for Consumers
Introduction
Stakeholders
Proposed Technical Solutions
Conclusion
References
Privacy for Online Communities
P2P Social Networks with Broadcast Encryption Protected Privacy
Introduction
Broadcast Encryption
Architecture: Privacy Preserving Profiles
Architecture: Operations
Security Considerations
Conclusions
References
Privacy by Design: Does It Matter for Social Networks?
Introduction
What Is Privacy?
PET and Privacy by Design Principles
Case Studies
Conclusion and Future Work
References
Privacy for eHealth and eID Applications
Privacy Preserving Mechanisms for a Pervasive eHealth System
Introduction
Related Work
System Description
Patients' Care Networks
Privacy as Preserved by the System
Security and Privacy Requirements
User Registration
Establishment of Connections
Handling Patients' Requests
Handling Caregivers' Requests
Handling Emergency Situations
Billing
Evaluation
Conclusions
References
Formalising Requirements for a Biobank Case Study Using a Logic for Consent and Revocation
Introduction
Related Work
Logic for C&R
Description of the Case Study
Formalisation of the Use Cases
The EnCoRe IT Administrator Creates C&R Options That Will Be Presented to the Patient
The Data Subject (Patient) or ORB Technician Makes CR Choices for Specific Study/Studies)
The Data Subject (Patient) or ORB Technician Changes CR Choices for Specific Study/Studies
Tissue Sample Collection, Data and C&R Choices Entry
The ORB Technician Is Registering a Sample and/or Personal Data in a Spreadsheet
Conclusion and Future Work
References
Privacy Protection Goals and Their Implications for eID Systems
Introduction
Protection Goals for Information Security and Privacy
Examples from the European eID Landscape
Use Cases for Designing Privacy-Respecting eID Systems
Testing and Launching the eID System
Use Cases for Identification, Anonymous or Pseudonymous Authentication
History Function - Overview of Past Transactions
Right of Access and Rectification
Revocation and Renewal of eID Credentials
Termination or Major Changes in the eID Lifecycle
Conclusion
References
Privacy Attacks and Problems
Avoiding Man-in-the-Middle Attacks When Verifying Public Terminals
Introduction
Preliminaries
Cryptographic Tools
TPM
Problem Statement
Model and Assumptions
Approach: Key Exchange or Identification
Requirements
Related Work
Analysis of Existing Schemes
General Proposal
Verification Scheme
Security Analysis
Conclusions
Further Research
References
Massive Data Collection by Mistake?
Introduction
Google StreetView
The Facebook 'Like' Button
Apple Location Data
Comparison of the Cases
Analysis and Future Perspective
References
Ethics
Addressing Governance and Ethics in European Technology Development Projects through Scenarios
Introduction
Ethics, Technology and Reflexive Governance
Ethics and Governance in EU co-Funded Technology Projects
Summary of Findings
Ethical Issue Determination Exercise
Summer School Workshop
Reflections on the Scenario
Conclusion
References
Author Index

Systemvoraussetzungen

Als PDF speichern Als Link merken