HP Helps Healthcare Providers Improve Patient Care and Regulatory Compliance

A recent Press Release, published by Yahoo! Finance and called “HP Helps Healthcare Providers Improve Patient Care, Regulatory Compliance with Medical Archiving Solution”, might be of some interest to the Identity and Privacy Management Community:

“HP today introduced a specialized archiving platform to help global healthcare providers, hospitals and imaging clinics of all sizes meet rapidly expanding retention requirements for medical images.

HP MAS 3.0 delivers factory-integrated HP ProLiant servers, HP StorageWorks SAN and MSA disk storage with indexing, policy management and search software to provide long-term retention of medical fixed content. The grid architecture of MAS satisfies the scalability and performance requirements of healthcare providers at an affordable price. The tiered storage of the MAS grid ensures healthcare providers can align the business value of images with appropriate retention policies.”

The management of privacy when handling personal data (in this case medical data) in healthcare contexts is very important. This is critical information. I am glad that commercial solutions are making their way to the market to address some of the related privacy management aspects.

More details are available in the article mentioned above.

--- NOTE: my original HP blog can be found here ---

W3C PLING Interest Group: Wiki site is now up and running …

The Wiki site of the W3C Policy Languages Interest group (PLING) is now up and running. Feel free to subscribe and add your contributions.

As anticipated in a previous post of mine, the current discussion topics are:

1) Use-cases involving the usage of policies in various scenarios, pros and cons of adopted policy frameworks, pain points, issues and recommendations

2) Review of Policy languages and frameworks that are currently used in the industry and research

--- NOTE: my original HP blog can be found here ---

W3C Policy Language Interest Group (PLING): Discussion Topics …

The W3C Policy Language Interest Group is now ready to start discussions on policy related topics. Of course, if you are interested in this topic, feel free to join the public mailing list.

The PLING's team contacts (Thomas and Rigo), Renato and I have received a few (off-line) emails asking for more information about PLING's next steps and discussion topics.

Given the PLING Charter, we suggest to start discussing these two key topics:

1) Use-cases involving the usage of policies in various scenarios, pros and cons of adopted policy frameworks, pain points, issues and recommendations

2) Creating a list of known policy languages & frameworks that are currently used in the industry, academy, etc. and/or are of relevance to the audience

Topic 1 aims at sharing practical experiences in using policies in a variety of contexts, along with any issue and requirements. The goal is to create awareness of important (and/or common) use-cases, limitations and needs.
Please notice this is NOT a discussion about specific policy language features.

Topic 2 aims at creating a list that "maps" the current "policy language" space, by clearly identifying policy languages and frameworks that the audience uses and/or believe are of some relevance.

Of course these two topics are not independent: discussions and contributions are really welcome on both themes.

The PLING team is also exploring the usage of a W3C Wiki site to record various discussions and contributions. More information on this aspect will follow.

We would also like to encourage the members of this mailing list to publicly introduce themselves by sharing their affiliation, interests, what they would like to get from this IG and/or how they would like to contribute (thanks to the ones that have already done it!) .

--- NOTE: my original HP blog can be found here ---

On Policies and Policy Management: Present and Future …

I have recently given a presentation on the topic of Policies and Policy Management. My presentation is available online, here.

This topic is extremely complex, considering the variety of aspects to be kept into account. This presentation reflects my (high-level) view about current status and some of the potential future research areas.

In the introduction part I tried to describe the concepts of policy and policy management from a wide perspective, highlighting some of the open issues and involved complexity. I’ve also described some of current HPL R&D work in the space of policy management applied to identity and privacy management.

I have then highlighted a few future R&D activities in this space that might be worth exploring. They include:

• Policy Refinement Process
• “Federated Policy Management” in Organisations
• Management of “Sticky Policies” in Information Flow
• Content-aware Access Control in Collaborative (Enterprise Web 2.0) Environments driven by Policies
• Overall Policy Lifecycle Management

Last but not least, I described again the opportunity of getting involved in the newly created W3C Policy Languages Interest Group and contributing to it.

Your comments and input are welcome.

--- NOTE: my original HP blog can be found here ---

Call for Papers: IEEE Workshop Policy 2008 (2-4 June 2008, NY)

The call for papers for Policy 2008 is now available online:

“POLICY 2008 is the 9th in a series of successful workshops, which since 1999 have provided a forum for discussion and collaboration between researchers, developers, and users of policy-based systems. This year, in addition to the latest research results from the communities working in any area of policy-based management and computing, we encourage contributions on policy-based techniques in support of all types of wireless networks: cellular, Wi-Fi, Mobile Ad Hoc, hybrids, etc.
Policy 2008 aims to bring together researchers and practitioners working on policy-based systems across a wide range of application areas including networking, privacy and security management, storage area networking, enterprise systems, and the Web.”

Topics of interest are classified in the following categories:

• Policy models and Languages
• Policy Applications
• Policies in Wireless Networks

Identity management, privacy and security are key topics of this workshop. Please consider submitting a paper.

More information about call for papers, Organising Committee and Program Committee is available online.

--- NOTE: my original HP blog can be found here ---

Part III - PLING: the W3C Policy Languages Interest Group

I have been asked by a few people what a new group member should discuss once involved in the W3C Policy Languages Interest Group (PLING).

I am sure that the discussions of this interest group and priorities will evolve and adapt over time, also based on the interests of this group. Of course, Renato and I will provide some input and guidance.

For the time being, I would personally encourage a new group member to start by sharing his/her own perspective/experience on:

• Which kind of policies (and languages) do you (or your organisation) use and for which purposes (e.g. security, access control, privacy, federated IdM, etc.)?
• In which contexts, environments (e.g. network, system, application, service, business levels, etc.) are policies deployed and used?
• Do you need to deal with heterogeneous set of policies? Do you have interoperability problems? How do you currently keep them consistent and up-to-date?
• Any relevant use cases and scenarios you would like to share with the group/community?
• Which issues did you come across (if any) when handling policies?
• What are the major pain points and limitations (if any) of current policy languages and related policy management systems?
• Any policy requirement or need you would like to share with the group?

--- NOTE: my original HP blog can be found here ---

Part II - Announcing PLING: the W3C Policy Languages Interest Group

In a previous post, I announced the creation of the W3C Policy Languages Interest Group (PLING) and briefly discussed the scope and mission of this group.

As a first step, I would like to invite people, interested in discussions on policies, policy interoperability, use cases, issues and requirements, to subscribe to the PLING Mailing list and start sharing their experiences and views.

We are also considering organising a PLING panel at WWW 2008. Your input on topics of interest to be discussed in this panel (along with your priorities) is welcome.

--- NOTE: my original HP blog can be found here ---

Announcing PLING: the W3C Policy Languages Interest Group

I am proud to announce the creation of the W3C Policy Languages Interest Group (PLING). Roberto Iannella (Research Scientist, NICTA, Australia) and I (Marco Casassa Mont, Senior Researcher, HP Labs, UK) are going to be the co-Chairs. Thomas Roessler and Rigo Wenning (W3C) are the initial Team Contacts:

“The Policy Languages Interest Group, part of the Privacy Activity, is a forum for W3C Members and non-Members to discuss interoperability questions that arise when different policy languages are used in integrated use cases, along with related requirements and needs”.

I would like to encourage people that have interests in the area of policy languages, interoperability, privacy, etc. to engage and share their experience, requirements, use cases and open issues. A PLING Mailing list is available.

The PLING Charter provides information about PLING mission, scope, deliverables, participation, communication and obligations. The proceedings of this Interest Group (mailing list archives, minutes, etc.) are going to be publicly visible.

The mission of this interest group is the following:

“The Policy Languages Interest Group is a forum for W3C Members and the public to discuss interoperability issues - along with related requirements and needs - that arise when using a variety of policy languages where there is a need to compute results across these multiple languages. The Interest Group follows up on the October 2006 W3C Privacy Workshop, and addresses areas of work identified as a key common interest of participants. An important function of the Interest Group is information sharing within and between application communities. …”

The scope of PLING is:

“The Policy Languages Interest Group is designed as a forum to support researchers, developers, solution providers, and users of policy languages such as XACML (eXtensible Access Control Markup Language), the IETF's Common Policy framework and related work, and P3P (W3C's Platform for Privacy Preferences Project). It provides a forum to enable broader collaboration, through use of email discussion, scheduled IRC topic chats, Wikis, and Weblog tools.

The group will primarily focus on policy languages that are already specified and broadly address the privacy, access control, and obligation management areas; it is not expected to engage in the design of new policy or rule languages. The Interest Group will work towards identifying obstacles to a joint deployment of such languages, and suggest requirements and technological enablers that may help overcome such obstacles.”

More information will follow.

--- NOTE: my original HP blog can be found here ---

On Federated Policy Management in Enterprises: Episode II …

In June I published a post about “Federated Policy Management”:

“Policies are used to drive access control decisions and enforce accesses to resources. How to “synchronise” policies that are used at different levels of abstraction – in complex telecom or enterprise environments?
Ideally an organisation might want to define high-level policies, check for their compliance and manage them in a centralised way. However, the idea of having a general purpose policy language is unfeasible, given the current legacy systems and the complexity of the real world.
In practice, different policies are defined and enforced at each different IT layers (e.g. network, system, OSs, middleware, application/services, etc.). Keeping these policies aligned with (high-level) business and security objectives and fully understanding the impact of local changes to the global context is often a challenging experience.”

In other words, the problem is how to “align” and keep consistent high-level policies with a multitude of lower-level policies, each of them potentially having their own operational context, their policy-decision-points (PDPs) and policy-enforcement-points (PEPs).

The idea of having a “Federation of Policies” would imply:

• Having a model of these multiple policies (syntax, semantic, ontology, etc.);
• Mapping dependencies between policies (that apply at the same IT layer and/or across IT layers);
• Having mechanisms to propagate changes top-down and bottom-up, depending on needs;
• Having “federated” mechanisms to translate these changes into policy modifications, at the right policy levels …
• Having a model of involved IT infrastructure (PEPs, PDPs, etc.) and associated requirements;
• Having (centralised?) supervision of all these policies, security, their auditing and compliance checking.
  

Has anybody in this community come across solutions or approaches to this problem?
Any other alternative approach to be aware of?