Technical enforcement of european privacy legislation: an access control approach

Kheira Bekara (1, 2, 3) , Maryline Laurent (4, 1, 2, 3) , Than Ha Nguyen (1, 2, 3)

1 TSP - RST - Département Réseaux et Services de Télécommunications
2 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
3 CNRS - Centre National de la Recherche Scientifique
4 R3S-SAMOVAR - Réseaux, Systèmes, Services, Sécurité

Until today, the protection of personal data is mainly left to the legislation by means of guidelines. This paper aims to increase the perceived control by users over their data by helping the user's agent to check the service requests conformity to the legislation. To do so, it discusses the main concepts involved in the legislative privacy principles, and deduces a privacy semantic information model. The proposed model focuses on the main concepts involved in legislative privacy principles. For proof of concept, we describe our proposed privacy semantic information model by means of privacy ontology. We use OWL as an implementation basis for defining privacy knowledge base, and SQWRL and the Jess rule engine to dynamically interact with that base and enforce legislative requirements as privacy access control rules

Mots clés: Privacy; Legislative requirements; Access control; Ontology

Domaines: Cryptographie et sécurité [cs.CR]; Web

Kheira Bekara, Maryline Laurent, Than Ha Nguyen. Technical enforcement of european privacy legislation: an access control approach. NTMS 2012 : 5th IFIP International Conference on New Technologies, Mobility and Security , May 2012, Istanbul, Turkey. pp.1 - 7, ⟨10.1109/NTMS.2012.6208724⟩. ⟨hal-01300733⟩