During the last 6 months, HP Labs provided key contributions involving the overall coordination of the UK collaborative EnCoRe project, the release of public architectural documents and the development of fully working R&D solutions in the areas of dynamic consent and privacy management.
Specifically this includes:
1. The Third EnCoRe Technical Architecture (D2.3) document;
2. The final HP Labs’ EnCoRe Service Framework: a General, Reference Implementation for Dynamic Consent and Privacy Management;
3. The HP Labs Demonstrator for Cabinet Office/Identity Assurance;
4. HP Labs papers on EnCoRe, dynamic consent and privacy management.
My previous blog posts provide the details.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Showing posts with label EnCoRe. Show all posts
Showing posts with label EnCoRe. Show all posts
Monday, January 9, 2012
EnCoRe: Third Technical Architecture D2.3
HP Labs led the overall design and delivery of the third EnCoRe Technical Architecture along with the release of a related EnCoRe public architectural document, D2.3 [1]. This architecture focuses on the third EnCoRe case study, centered on the UK Cabinet Office/Identity Assurance Programme [2].
The first EnCoRe Technical Architecture [3] was designed to fulfill the basic privacy management requirements of the first EnCoRe case study, centred on employee data and focusing on an organisational context. The second EnCoRe Technical Architecture [4], based on a Biobank scenario, fulfilled additional requirements including: the need to support more flexible and compelling privacy-aware policies beyond access control such as obligation policies; the need to ensure that data subjects’ privacy preferences are taken into account and enforced when personal data is shared with third parties. This architecture was designed to support future needs such as the ones related to the third case study. The third EnCoRe Technical Architecture primarily refines and finalises previous specifications in the following areas: flexible expression of privacy preferences (choices); tracking of data whereabouts; privacy-aware access control policies and obligation policies; sticky policies; logging, auditing and compliance checking. These refinements are driven by additional knowledge and requirements gathered in EnCoRe, during the second and third case studies.
Various use cases, related to the UK Cabinet Office/Identity Assurance Programme, have been taken into account to illustrate how EnCoRe can provide the desired capabilities in terms of dynamic consent and privacy management.
The third Technical Architecture document describes the resulting final EnCoRe architecture. Although inspired by, and focused on, the specifics of the third EnCoRe case study, this architecture is much more widely applicable than to just that scenario, being suitable for use in other scenarios where an individual (the data subject) discloses his or her personal data to an organisation, which may wish to disclose it to other organisations. Its legal ability to do so may depend on the specific details of the consent, granted by the data subject at the time of disclosure. At that time, the data subject may not be fully aware of the implications of granting consent, and/or may select the simplest consent options offered by the organisation. Later, perhaps after becoming more aware of these implications, or having just changed her mind, the data subject may wish to revoke the previously granted consents and be sure that her new wishes will be respected by all the organisations that have (or have access to) copies of the personal data she disclosed. In order for this to happen, a complex set of interactions, between and within the involved organisations, is required. The EnCoRe architecture provides the framework for these.
The third EnCoRe Technical Architecture document also provides clear and refined guidelines towards the implementation of a related technical solution, consisting of secure and self-standing services to support dynamic consent and privacy management within and across organizations.
These guidelines have been taken into account in the HP Labs’s EnCoRe Service Framework, which provides a general, reference implementation of the EnCoRe architecture and its core capabilities, as well as a framework to carry out additional research & development activities.
[1] D2.3 Technical Architecture for the third realized Case Study,, http://www.encore-project.info/deliverables_material/D2_3_EnCoRe_Architecture_V1.0.pdf
[2] UK Cabinet Office, Identity Assurance (IdA) Programme Statements, http://services.parliament.uk/hansard/Commons/ByDate/20110518/writtenministerialstatements/part003.html
[3] D2.1 Technical Architecture for the first realized Case Study, http://www.encore-project.info/deliverables_material/D2.1%20EnCoRe%20Architecture%20V1.0.pdf
[4] D2.2 Technical Architecture for the second realized Case Study, http://www.encore-project.info/deliverables_material/D2_2_EnCoRe_Architecture_V1.0.pdf
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
The first EnCoRe Technical Architecture [3] was designed to fulfill the basic privacy management requirements of the first EnCoRe case study, centred on employee data and focusing on an organisational context. The second EnCoRe Technical Architecture [4], based on a Biobank scenario, fulfilled additional requirements including: the need to support more flexible and compelling privacy-aware policies beyond access control such as obligation policies; the need to ensure that data subjects’ privacy preferences are taken into account and enforced when personal data is shared with third parties. This architecture was designed to support future needs such as the ones related to the third case study. The third EnCoRe Technical Architecture primarily refines and finalises previous specifications in the following areas: flexible expression of privacy preferences (choices); tracking of data whereabouts; privacy-aware access control policies and obligation policies; sticky policies; logging, auditing and compliance checking. These refinements are driven by additional knowledge and requirements gathered in EnCoRe, during the second and third case studies.
Various use cases, related to the UK Cabinet Office/Identity Assurance Programme, have been taken into account to illustrate how EnCoRe can provide the desired capabilities in terms of dynamic consent and privacy management.
The third Technical Architecture document describes the resulting final EnCoRe architecture. Although inspired by, and focused on, the specifics of the third EnCoRe case study, this architecture is much more widely applicable than to just that scenario, being suitable for use in other scenarios where an individual (the data subject) discloses his or her personal data to an organisation, which may wish to disclose it to other organisations. Its legal ability to do so may depend on the specific details of the consent, granted by the data subject at the time of disclosure. At that time, the data subject may not be fully aware of the implications of granting consent, and/or may select the simplest consent options offered by the organisation. Later, perhaps after becoming more aware of these implications, or having just changed her mind, the data subject may wish to revoke the previously granted consents and be sure that her new wishes will be respected by all the organisations that have (or have access to) copies of the personal data she disclosed. In order for this to happen, a complex set of interactions, between and within the involved organisations, is required. The EnCoRe architecture provides the framework for these.
The third EnCoRe Technical Architecture document also provides clear and refined guidelines towards the implementation of a related technical solution, consisting of secure and self-standing services to support dynamic consent and privacy management within and across organizations.
These guidelines have been taken into account in the HP Labs’s EnCoRe Service Framework, which provides a general, reference implementation of the EnCoRe architecture and its core capabilities, as well as a framework to carry out additional research & development activities.
[1] D2.3 Technical Architecture for the third realized Case Study,, http://www.encore-project.info/deliverables_material/D2_3_EnCoRe_Architecture_V1.0.pdf
[2] UK Cabinet Office, Identity Assurance (IdA) Programme Statements, http://services.parliament.uk/hansard/Commons/ByDate/20110518/writtenministerialstatements/part003.html
[3] D2.1 Technical Architecture for the first realized Case Study, http://www.encore-project.info/deliverables_material/D2.1%20EnCoRe%20Architecture%20V1.0.pdf
[4] D2.2 Technical Architecture for the second realized Case Study, http://www.encore-project.info/deliverables_material/D2_2_EnCoRe_Architecture_V1.0.pdf
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
HP Labs’ EnCoRe Service Framework: a General, Reference Implementation for Dynamic Consent and Privacy Management
HP Labs completed the development of the EnCoRe Service Framework for the management of dynamic consent and privacy within and across organisations [5]. This framework provides a general, reference implementation of EnCoRe technical capabilities, fully consistent and compliant with the third EnCoRe Technical Architecture [1].
The HP Labs Service Framework supports four general use cases that apply to all case studies explored in EnCoRe:
· A data subject (end-user) submits his/her personal data to an organization along with the expression of their consent preferences;
· An entity within the organisation trying to access personal data and being constrained (in so doing) by related data subjects’ consent preferences and policies. The organization uses EnCoRe to explicitly enforce (privacy) preferences and policies;
· The disclosure of personal data to a third party, along with associated consent preferences, via the sticky policy mechanism;
· A data subject subsequently changes their mind and modifies/revokes their consent. Changes are automatically propagated to all the involved parties;
More details about these use cases are available [1].
A fully working prototype has been built by HP Labs, to fully illustrate the capabilities of the EnCoRe Service Framework and the four general use cases.
Specifically, the Service Framework implements the following key EnCoRe Architectural capabilities [1]: module for the configuration of supported Privacy Preferences and Policies; the Consent/Revocation Provisioning module; the Data Registry module; the Privacy-aware Access Control module; the Obligation Management module; Internal and External Workflow Management modules; the Sticky Policy Management module; instantiation of types of Privacy Preferences, various Access Control and Obligation Policies.
The various components of the Service Framework have been implemented to run as self-standing, secure and distributed services within an organisation. The goal is to ensure that early adopters of the EnCoRe toolkits can use this framework to explore its privacy management capabilities and deploy an extended version of it within their IT operational environments.
The implementation uses state-of-the-art technologies based on the Java framework. It uses the REST [6] methodology and approach for a quick and flexible development of service interfaces and the exchange of information between the involved services. The EnCoRe components are implemented as self-standing RESTful services [7]. These service components can be distributed across different IT systems based on needs. Their implementation supports state-of-the art security, including encryption of data and secure SSL communication. The representation of information that is exchanged between these EnCoRe components uses the XML technology to support future extensions and quick adaptation to the needs of different organisations and their IT operational environments.
This framework has been used by HP Labs as a platform for experimentation of innovative privacy management and consent/revocation solutions. Specifically, HP Labs used it to develop and deploy advanced solutions for: the tracking of whereabouts of personal data (via an enhanced version of the Data Registry component); the management of sticky policies by means of a variety of possible technical approaches. The service framework now fully supports sticky policies as the mechanism to exchange personal data and privacy preferences across parties, in a safe and accountable way. A reference implementation is available as described in [8].
The HP Labs Service Framework is also an agile platform to develop demonstrators for a variety of needs, including prototypes of the overall system for the EnCoRe engagement with the Cabinet Office Identity Assurance Programme [2].
HP Labs are exploring the opportunity to release this Service Framework in the context of an Open Source initiative. This option is currently being discussed within EnCoRe and various involved organisations: a decision will be made towards the end of the project (April 2012).
[1] D2.3 Technical Architecture for the third realized Case Study,, http://www.encore-project.info/deliverables_material/D2_3_EnCoRe_Architecture_V1.0.pdf
[2] UK Cabinet Office, Identity Assurance (IdA) Programme Statements, http://services.parliament.uk/hansard/Commons/ByDate/20110518/writtenministerialstatements/part003.html
[3] D2.1 Technical Architecture for the first realized Case Study, http://www.encore-project.info/deliverables_material/D2.1%20EnCoRe%20Architecture%20V1.0.pdf
[4] D2.2 Technical Architecture for the second realized Case Study, http://www.encore-project.info/deliverables_material/D2_2_EnCoRe_Architecture_V1.0.pdf
[5] EnCoRe, HP Labs Service Framework, http://www.encore-project.info/newsletters/newsletter03/EnCoReAUG2011.html
[6] REST, http://en.wikipedia.org/wiki/Representational_state_transfer
[7] RESTLET, RESTful web framework for Java, http://www.restlet.org/
[8] Siani Pearson, Marco Casassa Mont, Sticky Policies: An Approach for Managing Privacy across Multiple Parties, IEEE Computer Magazine, Volume 44, Number 9, September 2011, 2011
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
The HP Labs Service Framework supports four general use cases that apply to all case studies explored in EnCoRe:
· A data subject (end-user) submits his/her personal data to an organization along with the expression of their consent preferences;
· An entity within the organisation trying to access personal data and being constrained (in so doing) by related data subjects’ consent preferences and policies. The organization uses EnCoRe to explicitly enforce (privacy) preferences and policies;
· The disclosure of personal data to a third party, along with associated consent preferences, via the sticky policy mechanism;
· A data subject subsequently changes their mind and modifies/revokes their consent. Changes are automatically propagated to all the involved parties;
More details about these use cases are available [1].
A fully working prototype has been built by HP Labs, to fully illustrate the capabilities of the EnCoRe Service Framework and the four general use cases.
Specifically, the Service Framework implements the following key EnCoRe Architectural capabilities [1]: module for the configuration of supported Privacy Preferences and Policies; the Consent/Revocation Provisioning module; the Data Registry module; the Privacy-aware Access Control module; the Obligation Management module; Internal and External Workflow Management modules; the Sticky Policy Management module; instantiation of types of Privacy Preferences, various Access Control and Obligation Policies.
The various components of the Service Framework have been implemented to run as self-standing, secure and distributed services within an organisation. The goal is to ensure that early adopters of the EnCoRe toolkits can use this framework to explore its privacy management capabilities and deploy an extended version of it within their IT operational environments.
The implementation uses state-of-the-art technologies based on the Java framework. It uses the REST [6] methodology and approach for a quick and flexible development of service interfaces and the exchange of information between the involved services. The EnCoRe components are implemented as self-standing RESTful services [7]. These service components can be distributed across different IT systems based on needs. Their implementation supports state-of-the art security, including encryption of data and secure SSL communication. The representation of information that is exchanged between these EnCoRe components uses the XML technology to support future extensions and quick adaptation to the needs of different organisations and their IT operational environments.
This framework has been used by HP Labs as a platform for experimentation of innovative privacy management and consent/revocation solutions. Specifically, HP Labs used it to develop and deploy advanced solutions for: the tracking of whereabouts of personal data (via an enhanced version of the Data Registry component); the management of sticky policies by means of a variety of possible technical approaches. The service framework now fully supports sticky policies as the mechanism to exchange personal data and privacy preferences across parties, in a safe and accountable way. A reference implementation is available as described in [8].
The HP Labs Service Framework is also an agile platform to develop demonstrators for a variety of needs, including prototypes of the overall system for the EnCoRe engagement with the Cabinet Office Identity Assurance Programme [2].
HP Labs are exploring the opportunity to release this Service Framework in the context of an Open Source initiative. This option is currently being discussed within EnCoRe and various involved organisations: a decision will be made towards the end of the project (April 2012).
[1] D2.3 Technical Architecture for the third realized Case Study,, http://www.encore-project.info/deliverables_material/D2_3_EnCoRe_Architecture_V1.0.pdf
[2] UK Cabinet Office, Identity Assurance (IdA) Programme Statements, http://services.parliament.uk/hansard/Commons/ByDate/20110518/writtenministerialstatements/part003.html
[3] D2.1 Technical Architecture for the first realized Case Study, http://www.encore-project.info/deliverables_material/D2.1%20EnCoRe%20Architecture%20V1.0.pdf
[4] D2.2 Technical Architecture for the second realized Case Study, http://www.encore-project.info/deliverables_material/D2_2_EnCoRe_Architecture_V1.0.pdf
[5] EnCoRe, HP Labs Service Framework, http://www.encore-project.info/newsletters/newsletter03/EnCoReAUG2011.html
[6] REST, http://en.wikipedia.org/wiki/Representational_state_transfer
[7] RESTLET, RESTful web framework for Java, http://www.restlet.org/
[8] Siani Pearson, Marco Casassa Mont, Sticky Policies: An Approach for Managing Privacy across Multiple Parties, IEEE Computer Magazine, Volume 44, Number 9, September 2011, 2011
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
EnCoRe Demonstrator for UK Cabinet Office/Identity Assurance Programme
HP Labs developed a fully working demonstrator to illustrate the EnCoRe capabilities (for dynamic consent and privacy management) in the context of the UK Cabinet Office/Identity Assurance Programme. This demonstrator fully leverages the EnCoRe third Technical Architecture [1] and the related HP Labs’s prototype based on the EnCoRe Service Framework [5].
The Identity Assurance Programme [2] aims to deliver a rich ecosystem of services and to use standard federated identity management solutions to enable the relevant interactions between citizens (users), Identity Providers (IdP), the Hub, Attribute Providers and Public/Private Service Providers (PSPs).
Specifically, a citizen, when trying to access an online PSP service, is redirected, via the Hub, to a trusted IdP of choice, where they can be identified and authenticated. The citizen does this by providing their authentication credentials (the type of credentials to be used might change depending on the required level of assurance).
Once authenticated at the IdP site, a Minimum Data Set (MIDS i.e. basic personal data such as name, surname, etc.) necessary to identify the data subject is passed to the Hub that might enrich it by adding additional information retrieved from Attribute Providers. Finally the Hub passes the MIDS data, along with any additional information, to the PSP, for local matching if identities (i.e. local identification/authentication) and to enable the citizen to access the desired services. The goal is to ensure that the asserted identity of a citizen can be successfully used at the PSP site, to identify the citizen based on the locally available information.
It is important to notice that, in the described scenario, lots of personal data can potentially be exchanged between the various stakeholders, related to authentication, matching (MIDS) and business transactions. To make this programme successful, it is important that citizens (data subjects) have control over how their personal data is disclosed between the various stakeholders and subsequently used; they must be allowed to change their consent and related privacy preferences at any time; they must have degrees of assurance that their preferences are enforced by the various stakeholders.
EnCoRe helps to provide citizens with the desired level of control over their personal data and the involved organisations with mechanisms and solutions for enforcing privacy and consent.
The HP Labs’ demonstrator illustrates how this can be achieved in practice, by animating the following key use cases:
-Use Case 1: a citizen (data subject) provides consent for the use of their personal data as MIDS
-Use Case 2: a citizen provides consent for the use of selected Attribute Providers for the MIDS matching process
-Use Case 3: a citizen provides consent for sending / using further Verified Attributes
-Use Case 4: ensuring privacy in transactions through the Hub by using sticky policies
-Use Case 5: changing and propagating data & consent updates
-Use Case 6: a citizen revokes consent for an IdP to hold their data at all
More details about these use cases are available [1].
The demonstrator uses the HP Labs’ EnCoRe Service Framework (and prototype, deployed via an EnCoRe toolbox) within 3 simulated environments: an IdP, the Hub and the Service Provider.
The demonstrator focuses on the viewpoint of end-users (citizens), administrators and employees. It illustrates how dynamic consent and privacy management can be achieved in this context.
HP Labs are available to provide demos to illustrate EnCoRe capabilities in the context of the Identity Assurance scenario and other scenarios.
[1] D2.3 Technical Architecture for the third realized Case Study,, http://www.encore-project.info/deliverables_material/D2_3_EnCoRe_Architecture_V1.0.pdf
[2] UK Cabinet Office, Identity Assurance (IdA) Programme Statements, http://services.parliament.uk/hansard/Commons/ByDate/20110518/writtenministerialstatements/part003.html
[3] D2.1 Technical Architecture for the first realized Case Study, http://www.encore-project.info/deliverables_material/D2.1%20EnCoRe%20Architecture%20V1.0.pdf
[4] D2.2 Technical Architecture for the second realized Case Study, http://www.encore-project.info/deliverables_material/D2_2_EnCoRe_Architecture_V1.0.pdf
[5] EnCoRe, HP Labs Service Framework, http://www.encore-project.info/newsletters/newsletter03/EnCoReAUG2011.html
[6] REST, http://en.wikipedia.org/wiki/Representational_state_transfer
[7] RESTLET, RESTful web framework for Java, http://www.restlet.org/
[8] Siani Pearson, Marco Casassa Mont, Sticky Policies: An Approach for Managing Privacy across Multiple Parties, IEEE Computer Magazine, Volume 44, Number 9, September 2011, 2011
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
The Identity Assurance Programme [2] aims to deliver a rich ecosystem of services and to use standard federated identity management solutions to enable the relevant interactions between citizens (users), Identity Providers (IdP), the Hub, Attribute Providers and Public/Private Service Providers (PSPs).
Specifically, a citizen, when trying to access an online PSP service, is redirected, via the Hub, to a trusted IdP of choice, where they can be identified and authenticated. The citizen does this by providing their authentication credentials (the type of credentials to be used might change depending on the required level of assurance).
Once authenticated at the IdP site, a Minimum Data Set (MIDS i.e. basic personal data such as name, surname, etc.) necessary to identify the data subject is passed to the Hub that might enrich it by adding additional information retrieved from Attribute Providers. Finally the Hub passes the MIDS data, along with any additional information, to the PSP, for local matching if identities (i.e. local identification/authentication) and to enable the citizen to access the desired services. The goal is to ensure that the asserted identity of a citizen can be successfully used at the PSP site, to identify the citizen based on the locally available information.
It is important to notice that, in the described scenario, lots of personal data can potentially be exchanged between the various stakeholders, related to authentication, matching (MIDS) and business transactions. To make this programme successful, it is important that citizens (data subjects) have control over how their personal data is disclosed between the various stakeholders and subsequently used; they must be allowed to change their consent and related privacy preferences at any time; they must have degrees of assurance that their preferences are enforced by the various stakeholders.
EnCoRe helps to provide citizens with the desired level of control over their personal data and the involved organisations with mechanisms and solutions for enforcing privacy and consent.
The HP Labs’ demonstrator illustrates how this can be achieved in practice, by animating the following key use cases:
-Use Case 1: a citizen (data subject) provides consent for the use of their personal data as MIDS
-Use Case 2: a citizen provides consent for the use of selected Attribute Providers for the MIDS matching process
-Use Case 3: a citizen provides consent for sending / using further Verified Attributes
-Use Case 4: ensuring privacy in transactions through the Hub by using sticky policies
-Use Case 5: changing and propagating data & consent updates
-Use Case 6: a citizen revokes consent for an IdP to hold their data at all
More details about these use cases are available [1].
The demonstrator uses the HP Labs’ EnCoRe Service Framework (and prototype, deployed via an EnCoRe toolbox) within 3 simulated environments: an IdP, the Hub and the Service Provider.
The demonstrator focuses on the viewpoint of end-users (citizens), administrators and employees. It illustrates how dynamic consent and privacy management can be achieved in this context.
HP Labs are available to provide demos to illustrate EnCoRe capabilities in the context of the Identity Assurance scenario and other scenarios.
[1] D2.3 Technical Architecture for the third realized Case Study,, http://www.encore-project.info/deliverables_material/D2_3_EnCoRe_Architecture_V1.0.pdf
[2] UK Cabinet Office, Identity Assurance (IdA) Programme Statements, http://services.parliament.uk/hansard/Commons/ByDate/20110518/writtenministerialstatements/part003.html
[3] D2.1 Technical Architecture for the first realized Case Study, http://www.encore-project.info/deliverables_material/D2.1%20EnCoRe%20Architecture%20V1.0.pdf
[4] D2.2 Technical Architecture for the second realized Case Study, http://www.encore-project.info/deliverables_material/D2_2_EnCoRe_Architecture_V1.0.pdf
[5] EnCoRe, HP Labs Service Framework, http://www.encore-project.info/newsletters/newsletter03/EnCoReAUG2011.html
[6] REST, http://en.wikipedia.org/wiki/Representational_state_transfer
[7] RESTLET, RESTful web framework for Java, http://www.restlet.org/
[8] Siani Pearson, Marco Casassa Mont, Sticky Policies: An Approach for Managing Privacy across Multiple Parties, IEEE Computer Magazine, Volume 44, Number 9, September 2011, 2011
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
HP Labs papers on EnCoRe, Dynamic Consent and Privacy Management
HP Labs have contributed to the dissemination of EnCoRe and related principles by means of HP internal and public presentations as well as with a variety of papers and articles published in prestigious, international conferences and magazines.
This post provides a list of selected, recent publications that illustrate HP Lab’s work in EnCoRe and future R&D directions:
- Siani Pearson, Marco Casassa Mont, Liqun Chen and Archie Reed, “End-to-End Policy-Based Encryption and Management of Data in the Cloud”, IEEE CloudCom 2011, 2011
- Siani Pearson and Marco Casassa Mont, “Sticky Policies: An Approach for Privacy Management across Multiple Parties”, IEEE Computer, vol 44, issue 9, pp. 60-68, September 2011
- Siani Pearson, “Towards Addressing Privacy, Security and Trust Issues related to Cloud Computing”, to appear in Privacy and Security for Cloud Computing, Computer Communications and Networks, Springer, 2012
- Nick Papanikolaou, Siani Pearson, Marco Casassa Mont and Ryan Ko, “Towards Greater Accountability in Cloud Computing through Natural-Language Analysis and Automated Policy Enforcement”, HPL-2011-118. Available via http://www.hpl.hp.com/techreports/2011/HPL-2011-118.html
- Nick Papanikolaou, Siani Pearson and Marco Casassa Mont, “Towards Natural-Language Understanding and Automated Enforcement of Privacy Rules and Regulations in the Cloud: Survey and Bibliography”, HPL-2011-117. Available via http://www.hpl.hp.com/techreports/2011/HPL-2011-117.html
- Yun Shen and Siani Pearson, “Privacy Enhancing Technologies: A Review”, HPL-2011-113. Available via http://www.hpl.hp.com/techreports/2011/HPL-2011-113.html
- Siani Pearson, “Toward Accountability in the Cloud”, View from the Cloud, IEEE Internet Computing, IEEE Computer Society, July/August issue, vol. 15, no. 4, pp. 64-69, 2011.
- Siani Pearson, Marco Casassa Mont and Gina Kounga, “Enhancing Accountability in the Cloud via Sticky Policies”, Secure and Trust Computing, Data Management and Applications, Communications in Computer and Information Science, vol. 187, Springer Berlin Heidelburg, pp. 146-155, 2011.
- Nick Papanikalaou, Siani Pearson and Marco Casassa Mont, “Towards Natural-Language Understanding and Automated Enforcement of Privacy Rules and Regulations in the Cloud: Survey and Bibliography”, Secure and Trust Computing, Data Management and Applications, Communications in Computer and Information Science, vol. 187, Springer Berlin Heidelburg, pp. 166-173, 2011.
- Marco Casassa Mont, Siani Pearson, Sadie Creese, Michael Goldsmith, and Nick Papanikolaou. “A Conceptual Model for Privacy Policies with Consent and Revocation Requirements.” Privacy and Identity 2010, volume 352, IFIP Advances in Information and Communication Technology, Springer, 2011.
- Siani Pearson and Azzedine Benameur, "A Decision Support System for Design for Privacy", Privacy and Identity 2010, volume 352, IFIP Advances in Information and Communication Technology, Springer, 2011.
- Marco Casassa Mont, Gina Kounga, Siani Pearson and Archie Reed, “End-to-End Policy-Based Encryption and Management of Data in the Cloud”, Proc. HP Techcon 2011.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
This post provides a list of selected, recent publications that illustrate HP Lab’s work in EnCoRe and future R&D directions:
- Siani Pearson, Marco Casassa Mont, Liqun Chen and Archie Reed, “End-to-End Policy-Based Encryption and Management of Data in the Cloud”, IEEE CloudCom 2011, 2011
- Siani Pearson and Marco Casassa Mont, “Sticky Policies: An Approach for Privacy Management across Multiple Parties”, IEEE Computer, vol 44, issue 9, pp. 60-68, September 2011
- Siani Pearson, “Towards Addressing Privacy, Security and Trust Issues related to Cloud Computing”, to appear in Privacy and Security for Cloud Computing, Computer Communications and Networks, Springer, 2012
- Nick Papanikolaou, Siani Pearson, Marco Casassa Mont and Ryan Ko, “Towards Greater Accountability in Cloud Computing through Natural-Language Analysis and Automated Policy Enforcement”, HPL-2011-118. Available via http://www.hpl.hp.com/techreports/2011/HPL-2011-118.html
- Nick Papanikolaou, Siani Pearson and Marco Casassa Mont, “Towards Natural-Language Understanding and Automated Enforcement of Privacy Rules and Regulations in the Cloud: Survey and Bibliography”, HPL-2011-117. Available via http://www.hpl.hp.com/techreports/2011/HPL-2011-117.html
- Yun Shen and Siani Pearson, “Privacy Enhancing Technologies: A Review”, HPL-2011-113. Available via http://www.hpl.hp.com/techreports/2011/HPL-2011-113.html
- Siani Pearson, “Toward Accountability in the Cloud”, View from the Cloud, IEEE Internet Computing, IEEE Computer Society, July/August issue, vol. 15, no. 4, pp. 64-69, 2011.
- Siani Pearson, Marco Casassa Mont and Gina Kounga, “Enhancing Accountability in the Cloud via Sticky Policies”, Secure and Trust Computing, Data Management and Applications, Communications in Computer and Information Science, vol. 187, Springer Berlin Heidelburg, pp. 146-155, 2011.
- Nick Papanikalaou, Siani Pearson and Marco Casassa Mont, “Towards Natural-Language Understanding and Automated Enforcement of Privacy Rules and Regulations in the Cloud: Survey and Bibliography”, Secure and Trust Computing, Data Management and Applications, Communications in Computer and Information Science, vol. 187, Springer Berlin Heidelburg, pp. 166-173, 2011.
- Marco Casassa Mont, Siani Pearson, Sadie Creese, Michael Goldsmith, and Nick Papanikolaou. “A Conceptual Model for Privacy Policies with Consent and Revocation Requirements.” Privacy and Identity 2010, volume 352, IFIP Advances in Information and Communication Technology, Springer, 2011.
- Siani Pearson and Azzedine Benameur, "A Decision Support System for Design for Privacy", Privacy and Identity 2010, volume 352, IFIP Advances in Information and Communication Technology, Springer, 2011.
- Marco Casassa Mont, Gina Kounga, Siani Pearson and Archie Reed, “End-to-End Policy-Based Encryption and Management of Data in the Cloud”, Proc. HP Techcon 2011.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Friday, December 2, 2011
On Dynamic Consent and Privacy Management: EnCoRe Third Architectural Document Available Online
The EnCoRe Third Technical Architecture is now available online.
This document now provides a fine grained description of a technical approach to deal with the management of dynamic consent and privacy within organisations and in distributed scenarios (e.g. the cloud and supply-chains).
Specifically, the document uses the EnCoRe third case study (focusing on the UK Cabinet Office/Identity Assurance Programme) to illustrate use cases and capabilities in a distributed environment, involving multiple Service Providers, Identity Providers, and Attribute Providers via Federated Identity Management.
HP Labs have implemented a fully working Service Framework - technology and demonstrator - supporting all the capabilities discussed in the architectural document. The demonstrator shows how dynamic consent and privacy management can be effectively deployed in a context such as the IDA Federated scenario.
We are keen in exploring potential technological trials, jointly with our HP business groups. Please contact me for more information.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
This document now provides a fine grained description of a technical approach to deal with the management of dynamic consent and privacy within organisations and in distributed scenarios (e.g. the cloud and supply-chains).
Specifically, the document uses the EnCoRe third case study (focusing on the UK Cabinet Office/Identity Assurance Programme) to illustrate use cases and capabilities in a distributed environment, involving multiple Service Providers, Identity Providers, and Attribute Providers via Federated Identity Management.
HP Labs have implemented a fully working Service Framework - technology and demonstrator - supporting all the capabilities discussed in the architectural document. The demonstrator shows how dynamic consent and privacy management can be effectively deployed in a context such as the IDA Federated scenario.
We are keen in exploring potential technological trials, jointly with our HP business groups. Please contact me for more information.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Monday, November 7, 2011
TSB Project Directory: Ensuring Trust in Digital Services
The Technology Strategy Board (TSB) has just released this Project Directory illustrating more than 20 funded projects in the space of trust, security, privacy and digital services.
The EnCoRe project is listed along with the current status and plans.
This document has been released in the contest of a joint event organised by TSB and the UK Cabinet Office/IDA Programme.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---The Technology Strategy Board (TSB) has just released this Project Directory illustrating more than 20 funded projects in the space of trust, security, privacy and digital services.
The EnCoRe project is listed along with the current status and plans.
This document has been released in the contest of a joint event organised by TSB and the UK Cabinet Office/IDA Programme.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
The EnCoRe project is listed along with the current status and plans.
This document has been released in the contest of a joint event organised by TSB and the UK Cabinet Office/IDA Programme.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---The Technology Strategy Board (TSB) has just released this Project Directory illustrating more than 20 funded projects in the space of trust, security, privacy and digital services.
The EnCoRe project is listed along with the current status and plans.
This document has been released in the contest of a joint event organised by TSB and the UK Cabinet Office/IDA Programme.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
HP Labs R&D Service Framework for Privacy and Consent Management
A fully working, new demonstrator has been built by HP Labs to illustrate EnCoRe capabilities in the space of consent and privacy management.
This demonstrator leverages the HP Labs R&D Service Framework (and a related prototype) i.e. a flexible and configurable service framework based on REST/RESTFul technologies. It is based on the EnCoRe Technical Architecture and can potentially be deployed in the context of an organisation, across organisations and the cloud.
It has been shown to the attendees of a recent joint Technology Strategy Board (TSB) and UK Cabinet Office/Identity Assurance (IDA) Programme event.
The demonstrator specifically showed how EnCoRe can be deployed in the IDA framework to support citizens and people in defining their privacy preferences as well as organisations in explicitly enforcing them.
HP Labs, along with EnCoRe, is actively engaging in the IDA Programme as well as looking for exploitation opportunities.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
This demonstrator leverages the HP Labs R&D Service Framework (and a related prototype) i.e. a flexible and configurable service framework based on REST/RESTFul technologies. It is based on the EnCoRe Technical Architecture and can potentially be deployed in the context of an organisation, across organisations and the cloud.
It has been shown to the attendees of a recent joint Technology Strategy Board (TSB) and UK Cabinet Office/Identity Assurance (IDA) Programme event.
The demonstrator specifically showed how EnCoRe can be deployed in the IDA framework to support citizens and people in defining their privacy preferences as well as organisations in explicitly enforcing them.
HP Labs, along with EnCoRe, is actively engaging in the IDA Programme as well as looking for exploitation opportunities.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Sticky Policies: An Approach for Managing Privacy across Multiple Parties
We recently published an article on IEEE Computer Magazine, September 2011 issue, about “Sticky Policies: An Approach for Managing Privacy across Multiple Parties”:
“Machine-readable policies can stick to data to define allowed usage and obligations as it travels across multiple parties, enabling users to improve control over their personal information. The EnCoRe project has developed such a technical solution for privacy management that is suitable for use in a broad range of domains.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
“Machine-readable policies can stick to data to define allowed usage and obligations as it travels across multiple parties, enabling users to improve control over their personal information. The EnCoRe project has developed such a technical solution for privacy management that is suitable for use in a broad range of domains.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Friday, July 1, 2011
HP Labs’ EnCoRe Service Framework for Privacy Management
HP Labs are developing an R&D Service Framework for the management of Consent/Revocation and Privacy, in the context of the EnCoRe project.
This work aims to provide a flexible, general purpose, agile and extensible R&D platform to further support the exploitation of EnCoRe technologies and solutions. We envisage using this Service Framework in the context of the EnCoRe engagement with the Cabinet Office, in their Identity Assurance Programme.
More details about this work are going to be published in the coming EnCoRe Newsletter.
References
[1] EnCoRe Architecture D2.1, http://www.encore-project.info/deliverables_material/D2.1%20EnCoRe%20Architecture%20V1.0.pdf, 2010
[2] EnCoRe Architecture D2.2, http://www.encore-project.info/deliverables_material/D2_2_EnCoRe_Architecture_V1.0.pdf, 2011
[3] UK Cabinet Office’s Identity Assurance Programme, http://www.publications.parliament.uk/pa/cm201011/cmhansrd/cm110518/wmstext/110518m0001.htm#11051863000116, 2011
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
This work aims to provide a flexible, general purpose, agile and extensible R&D platform to further support the exploitation of EnCoRe technologies and solutions. We envisage using this Service Framework in the context of the EnCoRe engagement with the Cabinet Office, in their Identity Assurance Programme.
More details about this work are going to be published in the coming EnCoRe Newsletter.
References
[1] EnCoRe Architecture D2.1, http://www.encore-project.info/deliverables_material/D2.1%20EnCoRe%20Architecture%20V1.0.pdf, 2010
[2] EnCoRe Architecture D2.2, http://www.encore-project.info/deliverables_material/D2_2_EnCoRe_Architecture_V1.0.pdf, 2011
[3] UK Cabinet Office’s Identity Assurance Programme, http://www.publications.parliament.uk/pa/cm201011/cmhansrd/cm110518/wmstext/110518m0001.htm#11051863000116, 2011
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Friday, April 29, 2011
EnCoRe General Meeting in Venice and Networking Event for EU Framework 7 Call 8
On April 12th-14th we had an excellent General Meeting of the EnCoRe project, in Venice.
Good discussions on the third case study, system framework design and architectural aspects.
In this context, a networking event has been held to explore collaboration opportunities for the coming EU FP7 Call 8. It has been a very successful meeting with exciting opportunities, in particular in the area of “Cloud Accountability”.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Good discussions on the third case study, system framework design and architectural aspects.
In this context, a networking event has been held to explore collaboration opportunities for the coming EU FP7 Call 8. It has been a very successful meeting with exciting opportunities, in particular in the area of “Cloud Accountability”.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
EnCoRe Project – 11th Quarter Summary
A summary of the project’s 11th quarter activities is available here.
In this context, the EnCoRe Architecture v.2 has now been fully completed and a related document will be published shortly. This release will feature new capabilities, including Obligation Management, support for Sticky Policies and improved Internal and external workflows for the management of consent and revocations.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
In this context, the EnCoRe Architecture v.2 has now been fully completed and a related document will be published shortly. This release will feature new capabilities, including Obligation Management, support for Sticky Policies and improved Internal and external workflows for the management of consent and revocations.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Thursday, March 11, 2010
The First EnCoRe Technical Architecture for the Management of Consent and Revocation is Available Online
The first EnCoRe Technical Architecture for the explicit management of consent and revocation on personal data has been published and is available online:
“This document is a formal deliverable of the EnCoRe project. It contains the definition of the EnCoRe Technical Architecture for the first realized Case Study: an Enhanced Employee Data Scenario. It also describes that scenario – specifically the use, by employees of an organisation, of a Web2.0-style service for work-related and personal purposes – and its related requirements regarding consent management. These requirements were gathered and defined by legal and social science research within the EnCoRe project, and were influenced by its concept formalisation research.
The scope of the EnCoRe Technical Architecture for this first Case Study encompasses all the technical functions required for the management (including capture and revocation) and enforcement of individuals’ consents that are pertinent to the Case Study‟s scenario. The technical architecture is the block-level design of the necessary technical system, at the level of functional blocks (i.e., software and service components) and the data flows between them and to/from humans, other technical systems, compliance and other business processes and regulatory environments. Its goal is to provide the basis for an EnCoRe reference implementation that validates the approach and the technology. To that end this document’s approach is to start with contextual information and overviews, and incrementally refine the level of detail. Most of this detail is contained within Appendices.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
“This document is a formal deliverable of the EnCoRe project. It contains the definition of the EnCoRe Technical Architecture for the first realized Case Study: an Enhanced Employee Data Scenario. It also describes that scenario – specifically the use, by employees of an organisation, of a Web2.0-style service for work-related and personal purposes – and its related requirements regarding consent management. These requirements were gathered and defined by legal and social science research within the EnCoRe project, and were influenced by its concept formalisation research.
The scope of the EnCoRe Technical Architecture for this first Case Study encompasses all the technical functions required for the management (including capture and revocation) and enforcement of individuals’ consents that are pertinent to the Case Study‟s scenario. The technical architecture is the block-level design of the necessary technical system, at the level of functional blocks (i.e., software and service components) and the data flows between them and to/from humans, other technical systems, compliance and other business processes and regulatory environments. Its goal is to provide the basis for an EnCoRe reference implementation that validates the approach and the technology. To that end this document’s approach is to start with contextual information and overviews, and incrementally refine the level of detail. Most of this detail is contained within Appendices.”
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Friday, January 22, 2010
TSB EnCoRe Project – Sixth Quarter Summary and other News
The Sixth Quarter Summary of the TSB EnCoRe Project (Ensuring Consent and Revocation - http://www.encore-project.info/) has been released: http://www.encore-project.info/press_archive/Q6%20summary.pdf
The EnCoRe website has also extended to provide the latest news and EnCoRe tidbits, related to aspects of privacy, consent and revocation of preferences: http://www.encore-project.info/news.html#story1
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
The EnCoRe website has also extended to provide the latest news and EnCoRe tidbits, related to aspects of privacy, consent and revocation of preferences: http://www.encore-project.info/news.html#story1
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Monday, November 2, 2009
Update about TSB UK EnCoRe Project – Ensuring Consent and Revocation
The 5th Quarter Summary of EnCoRe (http://www.encore-project.info) R&D activities in the space of Consent and Revocation management is now available online at: http://www.encore-project.info/press_archive/Q5%20summary.pdf
In addition, a new “service” has been launched, about “Latest EnCoRe Tidbits” aiming at providing links to snippets of news related to consent and revocation: http://www.encore-project.info/news.html#story1
More to come. Enjoy.
]--- NOTE: my original HP blog can be found here ---
In addition, a new “service” has been launched, about “Latest EnCoRe Tidbits” aiming at providing links to snippets of news related to consent and revocation: http://www.encore-project.info/news.html#story1
More to come. Enjoy.
]--- NOTE: my original HP blog can be found here ---
Tuesday, August 25, 2009
Good progress in the TSB EnCoRe Project – Ensuring Consent and Revocation
The TSB EnCoRe project (Ensuring Consent and Revocation) is making good progress towards his various objectives, involving the provision and management of consent and revocation.
This topic has been tackled from various perspectives including: legal and social aspects, user requirements, architectural and technological aspects, risk assessment and compliance.
More information is available on the EnCoRe web site, including a brief summary of the project’s fourth quarter activities.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
This topic has been tackled from various perspectives including: legal and social aspects, user requirements, architectural and technological aspects, risk assessment and compliance.
More information is available on the EnCoRe web site, including a brief summary of the project’s fourth quarter activities.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Wednesday, March 18, 2009
Do Enterprises know where they store personal data?
Apparently most of enterprises don’t, at least based on this survey, called “Safeguarding the Currency of Business”, where they found that "71 percent of organizations queried said they did not have an accurate inventory of where personal data for employees and customers is stored".
This has strong implications (among other things …) from a privacy perspective, in particular from a consent and revocation management angle – as also currently highlighted in a recent HP Labs report of ours (“On the Management of Consent and Revocation in Enterprises: Setting the Context”).
Hopefully we will explore how to tackle some of the related issues in the UK TSB EnCoRe project.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
This has strong implications (among other things …) from a privacy perspective, in particular from a consent and revocation management angle – as also currently highlighted in a recent HP Labs report of ours (“On the Management of Consent and Revocation in Enterprises: Setting the Context”).
Hopefully we will explore how to tackle some of the related issues in the UK TSB EnCoRe project.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Thursday, March 12, 2009
Twitter and its Privacy and Identity Management Implications
I recently started using Twitter (my link: http://twitter.com/MCasassaMont).
Twitter it getting more and more popular within (and across) organisations in particular for geographically distributed teams, to share their activities and whereabouts.
I am interested to better understand this tool, in particular in terms of its identity and privacy implications and long term repercussions for individuals and organisations.
I see some interesting research to be potentially carried out in the context of the Identity Analytics R&D project at HP Labs and UK TSB EnCoRe project.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Twitter it getting more and more popular within (and across) organisations in particular for geographically distributed teams, to share their activities and whereabouts.
I am interested to better understand this tool, in particular in terms of its identity and privacy implications and long term repercussions for individuals and organisations.
I see some interesting research to be potentially carried out in the context of the Identity Analytics R&D project at HP Labs and UK TSB EnCoRe project.
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: my original HP blog can be found here ---
Friday, December 5, 2008
Built-in Data Loss Prevention and Analogy with Privacy Management
I have just read this interesting article, called “Microsoft, RSA Partner to Develop Next-Gen data Loss Prevention”, by Lawrence Walsh:
“The alliance between Microsoft and RSA will move data loss prevention technology into the fabric of the IT infrastructure and improve protection by associating data with identities and classifications. Analysts are already calling the idea a "game changer.””
The main message I got is that we need to move away from bolt-on solutions, towards “built-in DLP approaches”. I tend to agree with this approach, despite being much harder to achieve.
This has some interesting analogies with privacy and the way privacy management is currently carried out, at least with most of current privacy-enhancing technology (PET) approaches. I believe that we need to move toward built-in approaches too, that require deep understanding of the interconnections with the relevant “IT infrastructure fabric”, related business processes (and needs), along with involved risks and their potential impact.
So, I believe this is something to consider very carefully, for example, in the context of the “Consent and Revocation Management” R&D area, within the TSB EnCoRe project.
--- NOTE: my original HP blog can be found here ---
“The alliance between Microsoft and RSA will move data loss prevention technology into the fabric of the IT infrastructure and improve protection by associating data with identities and classifications. Analysts are already calling the idea a "game changer.””
The main message I got is that we need to move away from bolt-on solutions, towards “built-in DLP approaches”. I tend to agree with this approach, despite being much harder to achieve.
This has some interesting analogies with privacy and the way privacy management is currently carried out, at least with most of current privacy-enhancing technology (PET) approaches. I believe that we need to move toward built-in approaches too, that require deep understanding of the interconnections with the relevant “IT infrastructure fabric”, related business processes (and needs), along with involved risks and their potential impact.
So, I believe this is something to consider very carefully, for example, in the context of the “Consent and Revocation Management” R&D area, within the TSB EnCoRe project.
--- NOTE: my original HP blog can be found here ---
Monday, October 27, 2008
Part II: TSB EnCoRe Project – Ensuring Consent and Revocation
In a previous post of mine, I announced the UK TSB EnCoRe project, focusing on research on Consent and Revocation.
A new version of the EnCoRe web site is now available online.
I would be interested in getting your views and input on two aspects:
- Prior art and work in the space of consent and revocation. In a first analysis, very little work is available in terms of automation of revocation of consent, in a wide sense. Any known work/solution in this space?
- Your (user) requirements in the space of consent and revocation
--- NOTE: my original HP blog can be found here ---
Subscribe to:
Posts (Atom)